prevents user from disabling passwords without having connected their Clef account; fixes #13