[encryption] improved error handling during password change

- only start migration if the encryption was initialized
- allow to overwrite keys until the user logged in for the first time

fix #8606 

cc @PVince81