New method changeUserPassword added, supervisor role is allowed to call it

This should fix #50 (closed) issue. Hardcoded check inside changePassword endpoint is not removed currently. To be removed later