Currently only administrators groups allow to modify accounts. This is impractical on very big installations. Add modify account global capability and allow administrators to optionally delegate this job. Bug: Issue 2786 Change-Id: Icc105c39e76908a075e89ec14921972b91866dd4