Support .well-known/change-password

[fisharebest]

https://github.com/w3c/webappsec-change-password-url

[miqrogroove]

If added, please make it easily to disable.

I currently have password changes disabled via code hacks, because I'm using an external authentication mechanism with its own password storage. While I haven't had the time to write a module for this, my preference is to keep those hacks relatively simple.