Implement a fine-grained user tokens and passwords permissions

[gritukan]

For now, password and token of user can be changed either by a user themselves or by superuser. This is not convenient since administrator of a team willing to issue tokens for users should not become a cluster superuser for such a task.

The proposed solution is to check "administer" permission for user, so required permissions can be granted granularity. In this case, administrator specify acl for newly created user and can issue token for them afterwards.