Fixes #8745 Added change_password feature.

The administrator can now force a user to change their password upon login. If
the force_password_reset flag is true, the user is taken to a page which asks
the user for their new password and to confirm it. Then it forwards the user to
the original url they were trying to visit if available.
I think you could just update the user using the update method in this controller. A second route is unnecessary in my opinion.