- don't allow changing the password until it's ready