Redmine

To improve the security of a fresh Redmine installation, I propose to force a password reset for the default admin account on first login.

If this change is applied, the installation instructions would need to be updated accordingly.

Unit test should not be affected, since they solely rely on fixtures and not default data created using migrations.

The attached patch, adds a migration which sets the must_change_passwd field to true for the default admin account, if it was not used yet (last_login_on: nil). This should make sure, that existing installations are not affected and the changes are only applied during the initial rake db:migrate run.