explicitly disable password authentication for non-SFTP users