added an admin-only api endpoint for forcibly setting a user's password
Merge remote-tracking branch 'upstream/development' into development