Add option to disable passwords for custom roles

This addresses the disabling aspect of #76.

props to @lolux for thinking through the UX here.