Users without moodle/site:config capability can reset passwords