Admins should be able to reset users' passwords. The user should receive an email with his new password. Admins cannot change other admins' passwords.