if users.mutableUsers is false, require root password to be set