move user administration to universal. fix bug for non-superuser to edit their own User (UserAdmin.change_view relies on the password being in the fieldset)