force password change for first login

Eventually we will remove the default user, https://issues.jboss.org/browse/AGPUSH-107

but for the august time frame, we decided to make the user change the password on first login.

I've also update the default user to only have a role of "user", which doesn't give them access to any other endpoints.

once they change the password, they are granted the "developer" role

This is only a Temporary solution until we get scripts to create users