Normally the operation log doesn't include operations performed by users
that are not logged in, but we want to make an exception for the change
user password form, which is used for changing expired passwords, that
doesn't log the user in, but we still want to have it logged.
Also, update the default value of mask_fields to include the field
names used in that form.
Change-Id: Ib07efeda9eecd78b91f8f13624578264282c3f89
079eceb2c2