Fix wording

Changed forgot-password so that it does not expose to the user that the email address does not exist.

app/main/views/forgot_password.py

@@ -1,4 +1,4 @@
-from flask import render_template, flash
+from flask import render_template, flash, current_app
 from app.main import main
 from app.main.dao import users_dao
 from app.main.forms import ForgotPasswordForm
@@ -7,9 +7,12 @@ from app.main.views import send_change_password_email
 
 @main.route('/forgot-password', methods=['GET', 'POST'])
 def forgot_password():
-    form = ForgotPasswordForm(users_dao.get_user_by_email)
+    form = ForgotPasswordForm()
     if form.validate_on_submit():
-        send_change_password_email(form.email_address.data)
-        return render_template('views/password-reset-sent.html')
+        if users_dao.get_user_by_email(form.email_address.data):
+            send_change_password_email(form.email_address.data)
+            return render_template('views/password-reset-sent.html')
+        else:
+            current_app.logger.info('The email address used does not exist.')
     else:
         return render_template('views/forgot-password.html', form=form)

app/main/views/new_password.py

@@ -10,7 +10,7 @@ from app.main.views import send_sms_code, check_token
 def new_password(token):
     email_address = check_token(token)
     if not email_address:
-        flash('The token we sent you has expired. Enter your email address to try again.')
+        flash('The link in the email we sent you has expired. Enter your email address to resend.')
         return redirect(url_for('.forgot_password'))
 
     user = users_dao.get_user_by_email(email_address=email_address.decode('utf-8'))