config: enable shadow passwords unconditionally