[welcome] Do not require password to be unset, and support the case of both welcome_code and reset_code