set encrypted flag to None for root device

"AWS API doesn't support any value for this flag for the root device of
a new instance"

see: boto#2587

closes gh-455