Disallow low user password reset timeout, impose reasonable minimum

pradhumanjain2311 → made their first commit to this issue’s fork.

The exact minimum is TBD. I propose 5 minutes, which is far safer than the current minimum of … no minimum (which realistically allows one attempt per second, given a form must be submitted and an e-mail received).