added apiserver and api client implementation of change password.

Added the api server and client set password command

Added the change-password user command

Thing to consider: 
> SetPassword only lets you change the password of the currently logged in user. Should the api really force this or should the commands force this behaviour (but not allowing the user to be specified)

> The change-password command writes the new password back to the yaml. Maybe the new file should be output as well?
Please note that we already have this problem in the agent code, and I'd really like to avoid us having parallel implementations for the same problem. And remember that a dropped connection could imply either success of failure setting the password on the server side: I think the only workable approach is to pick a password, record it, set it on the server, and (on success) drop the record of the original password.

Then we need handling for files with both passwords: try the new one, if it works drop the old one; otherwise try the old one and drop the new one.

It's not going to be very nice to extract that code from the agent stuff, but I don't think there's any good reason to have two different ways of dealing with the exact same problem.