An administrator should be allowed to reset passwords for a user, at least until we implement login with emails.