Add change password feature (for internal authentication method)

[mebster]

Consider forcing the user to change password on first login or rethink the registration process to ask users to enter new password (separate issue?)