User can now change password and admin can force user to change password