Force reset password on next login

[evert]

There should be a flag on user accounts that forces the user to create a new password the next time they login. This can for example be used when an admin sets up a new user account and gives them a temporary password.

This is probably easier to do after #26 and #34