call password set for change password

close #7024

- ensure HTML version is acutally HTML formatted
- added valid text version

fixes #6814
original issue #6748

this is not available in PHP >5.4.0 anyway.

> This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP
5.4.0.

http://php.net/manual/en/features.safe-mode.php

Fixes #6514: advanced application SignupForm::signup() should not return User model if saving failed

Removed User.role from advanced application template because it was causing confusion that user could be assinged a single RBAC role and that role field is somehow tied to RBAC at all.

Fixes #6404: advanced application template `Alert` widget was generating duplicate IDs in case of multiple flashes

Fixes #6103: Improved codeception config in app templates to ease testing of advanced app on multiple hosts

Fixes #4827: default config for functional tests of both basic and advanced app now turns off CSRF validation while providing commented out alternative setting cookie domain to localhost

Fixes #5598: added ImageMagick with PNG and GD with FreeType checks to requirements of basic and advanced applications, used better Captcha exception message

Fixes #5088: new password reset token is now generated only if previous one was already used or expired

delete spaces

- in composer the `~` operator is just a shortcut for `~1.0` = `>=1.0.0,<2.0.0`
  it does not prevent dev versions to be installed but neither does `1.*`
- dev versions are constrolled via `minimum-stability` setting and the
  `@dev`, `@beta`, `@stable`,... settings.
- setting bower packages that ship compiled files only with the stable
  release to use `@stable` in composer.json of the applictaions. This
  setting can be removed when we remove the `minimum-stability=dev`
  setting after GA.

fixes #5119