deny password change if password login disabled