Fixes #8745 Added change_password feature.

The administrator can now force a user to change their password upon login. If
the force_password_reset flag is true, the user is taken to a page which asks
the user for their new password and to confirm it. Then it forwards the user to
the original url they were trying to visit if available.
No need to check the method type of the request this as far as I can see