Admin Temporary Token has Full Access

[BNMoyers]

Currently, the admin token expires after one day, but has full admin rights. This token is not encrypted and is included in the url; this creates a security issue for 24 hrs after the token is created.

Proposed solution: limit the token's access to creating a password if one doesn't already exist.