[support] disallow password change?