[FIX] add check for disable_master and password_spent

besides check in settings.js also added to JSON schema, but we're currently not using the AccountSettings schema to validate
[DOC] update release notes
[DOC] add changed endpoints to release notes
[TASK] shrinkwrap packages for dependency locking
[TEST] read package and api version from package.json
[TEST] un-skip _payment tests
[TASK] bump version to 1.3.0-rc5