add setting to control password reset and %password availability

the only reason we *need* to reset the password is to support including %password in the emails. however:

a) the 1-time login URLs are better anyway (easier to use, require the user to reset their password, etc).
b) the fact this module will now always reset a users's password whenever it goes from blocked to active is a little wonky.

it'd be better to just have a setting to control if the password is reset, which then makes %password an available placeholder in the email bodies. this would default to off, so that the module never resets passwords unless site admins go out of their way to configure it to work that way.