core: also evaluate master password