Rather than flashing a message to check the user's email, display a
persistent message on the reset password form if the code has not been
prefilled.