initial-setup accepts weak passwords