Disable `old_passwords` by default

partially addresses #88