Fixes #8745 Added change_password feature.

The administrator can now force a user to change their password upon login. If
the force_password_reset flag is true, the user is taken to a page which asks
the user for their new password and to confirm it. Then it forwards the user to
the original url they were trying to visit if available.
Leave this method empty, the server will already log automatically that it's a GET request to /change_password