Setting shell to /bin/nologin for new users (even if they are --disabled-login already)