Stop enumeration of email addresses via forgot pw

https://www.pivotaltracker.com/story/show/113840073

Previously the forgot password page would give an error if you entered an email
address which didn’t belong to an account.

This would allow a potential attacker to know which email addresses were
registered.

This commit changes the response to always be the same, whether or not the email
address exists.

Also, this is a good read about the dangers of asserting whether a mocked method
was called: http://engineeringblog.yelp.com/2015/02/assert_called_once-threat-or-menace.html

tests/conftest.py

@@ -41,7 +41,7 @@ def mock_send_sms(request, mocker):
 
 @pytest.fixture(scope='function')
 def mock_send_email(request, mocker):
-    return mocker.patch("app.notifications_api_client.send_email")
+    return mocker.patch("app.notifications_api_client.send_email", autospec=True)
 
 
 @pytest.fixture(scope='function')
@@ -287,6 +287,18 @@ def mock_get_user_by_email(mocker, api_user_active):
     return mocker.patch('app.user_api_client.get_user_by_email', side_effect=_get_user)
 
 
+@pytest.fixture(scope='function')
+def mock_dont_get_user_by_email(mocker):
+
+    def _get_user(email_address):
+        return None
+    return mocker.patch(
+        'app.user_api_client.get_user_by_email',
+        side_effect=_get_user,
+        autospec=True
+    )
+
+
 @pytest.fixture(scope='function')
 def mock_get_user_by_email_request_password_reset(mocker, api_user_request_password_reset):
     return mocker.patch(