core: mlock password fields