POSTing to /admin/users/:id should only set the password if the the user IsLocal or IsOauth2 Fix #12952 Signed-off-by: Andrew Thornton <art27@cantab.net>