auth: Forbid password reset for non-local users

Also allow an administrator to lift the force password change flag without
specifying a new password.
Merge pull request #570 from greezybacon/issue/non-local-staff-pwreset

auth: Forbid password reset for non-local users

Reviewed-By: Peter Rotich <peter@osticket.com>