Password change MU

closes #4624
- added user_id to password reset request
- hide old password field
- updated changePassword method to check permissions
- updated changePassword method to work without oldPassword
- fixed bug for errors shown as [Object object]
Sorry if I'm missing it but why does `userId` need to be passed in?  `saveNewPassword` is an instance method so we should just be pulling the `id` off `this`.