manage_updatePasswordForm allows DoS against other users

As an authenticated user, manage_updatePasswordForm allows me to change my login name, however no check is made to ensure this new login name is unique. This means I can set my login name to the same as someone else, preventing them from logging in. The effects are persistent for the victim, as the attacker I can reset my name back to the original and the victim will still be unable to log in (as there is now no mapping of their login name to any other user). Also, attempting to reset the victims login name via the management interface raises an exception (again due to the missing mapping).

(Line 483 onwards, ZODBUserManager.py)