Separate permission for forcing individual users to change their passwords

Problem Description

Currently this module assumes that any user that would need to force password changes can do so globally on all user accounts. There are some usecases where a site will delegate user management to non-administrative users via modules such as administerusersbyrole.

In this scenario, you would not want to grant these lower privilege users the "administer force password change" permission as that may allow a lower privileged user to force an administrative user to change their password.

Proposed Solution

• Create a separate permission for forcing password changes on the user edit screen.
• Modify the hook_form_alter() implementation in the .module file to allow triggering a password change if the current user has either permission.
• Add an action plugin to allow bulk triggering password changes on multiple user accounts.

Patch will be submitted shortly to support this.