do not allow root user without password unless explicitly enabled by AllowEmptyRoot