OK, finished the fixes I wanted to add to the recent LDAP changes

OK, finished the fixes I wanted to add to the recent LDAP changes
for user field locking and forcing of password changing

  - Locked user fields always apply (for any authentication method).
    Currently these can only be defined in the LDAP auth screen
    but later these can be brought out as part of the generic
    interface for defining user fields and their behaviour.

  - Fields are now locked using Javascript and will work for any
    user fields that exist (list is not hard coded anymore).

  - Admins can always edit locked fields.

  - Admins can always force a password change.  The checkbox reflects
    the current status of this, and the admin can UNSET the checkbox
    if they want.  It is no longer necessary for the admin to change
    the old password for this to take effect, either.