allow changing passwords for other users

if a user has the explicit "users:passwordchange:*" permission they can change passwords for other users without supplying the old password
if a user has non-wildcard permissions for changing passwords, the old password must be supplied and is checked, this is really only useful for changing one's own password.
some additional debug logging

fixes #340