[FIX] add check for disable_master and password_spent

besides check in settings.js also added to JSON schema, but we're currently not using the AccountSettings schema to validate