Refactored to separate UserController and LoginController.
Admin users can change other user passwords.
Normal users can only change their own passwords.