After playing around with the Web UI for a bit I found that a refresh of the user's page gives back access to the Reset Password option, but just for that view. If you go to another user the problem resurfaces. I have confirmed this happens in both chrome and firefox running in both Windows or Linux. The httpd logs show nothing there, /var/log/ipa logs aren't helpful either.
IPA got some updates recently (which also appear to have broken pki-tomcatd), but I'm not sure if the two problems are related.