add parameter for vas.conf: disabled-user-pwhash & locked-out-pwhash

Why does this have to be moved?