added role 'chpwDenied' to deny password change for users (fixes #32)