Administrator account takeover via tokenless password reset

CSRF in JATOS 3.9.3 allows remote authenticated users to reset an administrator's password through a malicious imported study. The study embeds a form that posts a chosen password and administrator username to /jatos/user/passwordByAdmin, which processes the state-changing request without a CSRF token. An administrator must import and run the attacker-controlled study; the password change then permits takeover of that administrator account and access to studies and user-management functions.