disable password-related settings in settings controller