Updated the permissions for changing a user's password.

When one user attempts to change another user's password, they must either be an admin or they must have the user setup privilege and be privileged in a class where the user whose password is being changed is restricted and the user whose password is being changed cannot be privileged in any class and must have had their account created via the user setup API.

Closes #589