Merge changes If8296539,Id907cc10

* changes:
  Close security hole allowing normal user to become admin
  Remove the generateHttpPassword capability