Missing change from last commit.
Users can be created with empty passwords. Users can set passwords later.
Better "change password" page.