fix(admin): a forced password change cannot trap a user or be skipped with a token

- The administrator's password form took "password-based
  authentication: Disabled" with "must change it at the next login":
  the change form asks for the old password, which the user then never
  had, so they could not get past it. That combination is refused, and
  an administrator cannot disable their own password.
- A user who must change the password could still use the API with
  their tokens. A token is now refused until they change it, as the
  pages are.

admin/forms.py

@@ -133,3 +133,10 @@ class AdminPasswordForm(AdminPasswordChangeForm):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.fields["must_change_password"] = self.fields.pop("must_change_password")  # last, after Django's own
+
+    def clean(self):
+        cleaned = super().clean()
+        # the change form asks for the old password: a user without one could never pass it
+        if cleaned.get("must_change_password") and not cleaned.get("set_usable_password", True):
+            raise ValidationError(_("A user without a password cannot be made to change it"))
+        return cleaned