These were not needed at the end of most tests for quite some time,
since rails clears them by default for controller and integration tests,
and also no longer required in system tests after #5691
This implements what is known as "paranoid" password reset flash
messages (using the terminology from Devise). It avoids revealing
whether the supplied email address is already registered.
Added an explicit test for this situation, so that the test for
email non-existance is separate from the duplicate-case tests.