User can change their passwords now.

There's kind of ldap support but it is not tested.

closes #30