Allow site administrators more in-app control over other users

[mrueschman]

More and more people are reporting not receiving emails sent from the portal (support@lofthf.study). This is making it difficult to have users confirm their email addresses or reset forgotten passwords. I assume this is due to heightened spam/phishing filtering at many academic/healthcare institutions. I think trying to have external users track down and get support@lofthf.study (or other portal) email addresses whitelisted isn't practical.

Proposal: Allow admins on the site to perform actions such as:

1. Confirm email address for user
2. Reset password for user (perhaps by generating password reset link w/ token that can then be emailed directly to the user by admin)

[remomueller]

Hmm, both of these present security risks for users. Example, if someone doesn't confirm their email, they can sign up as someone else in their organization. We can try altering the text in the emails potentially to avoid falling into phishing?

[mrueschman]

My expectation was this for be to a rarely used function in the edge scenario where a user absolutely cannot receive an email from the application to confirm and/or reset password. I would expect them to be in touch by email once the normal route failed, at which point a portal admin would have had 1-on-1 contact with the person (thereby "confirming" the person they're communicating with actually used the email address).

This can be tabled at the moment since portal activity (here and HELP-DS) is likely to slow down for new users. Thanks!