Drop 'allow_admin_set_passwords' setting altogether: always allow.