Description of problem:
The default included "modify hosts" permission can't truly "modify" hosts.

Version-Release number of selected component (if applicable):
3.3.4-3

How reproducible:
Always

Steps to Reproduce:
1. Create a user that has a role with the "modify hosts" permission
2. Attempt to modify a host:

[fedora@ipa01 ~]$ ipa host_mod testbox.example.com --random

Actual results:
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'userPassword' attribute of entry
'fqdn=testbox.example.com,cn=computers,cn=accounts,dc=example,dc=com'.

Expected results:
Update succeeds and I receive a new OTP

Additional info:
At a minimum, I'd like to be able to specify a userclass and set a new OTP