added apiserver and api client implementation of change password.

Added the api server and client set password command

Added the change-password user command

Thing to consider: 
> SetPassword only lets you change the password of the currently logged in user. Should the api really force this or should the commands force this behaviour (but not allowing the user to be specified)

> The change-password command writes the new password back to the yaml. Maybe the new file should be output as well?
@mjs Not sure I understand the problem here. I thought SetPassword was consistent with the other apis in the use of Tag. The only place SetPassword differs is here:

    argUser, err := api.state.User(arg.Username)

To be consistent with the other apis I think we should change this to be:

    username := arg.Username                                                
    if username == "" {                                                     
        username = arg.Tag                                                  
    }   
    argUser, err := api.state.User(username) 

Does this sound right, Or have I misunderstood your concern?