Fixes #8745 Added change_password feature.

The administrator can now force a user to change their password upon login. If
the force_password_reset flag is true, the user is taken to a page which asks
the user for their new password and to confirm it. Then it forwards the user to
the original url they were trying to visit if available.
```User.current.admin?``` should suffice.