r19058: Implement "user cannot change password", and complete "user must change