Allow User To Unlock Password Only

[sfisher]

When you enable the active directory actions in the template it enables a new option in the password record. It displays the option to unlock the account if locked, user must change password at next logon, disable the account and enable the account. We would like to ability to only grant the user only access to unlock their account if they have read only access to the record. The user should not be able to select the other options.