disable ability to remove password

[lastmeta]

Describe The Task

users must have a user-defined password for mvp, so we don't want them to be able to remove it.

Additional Context

password flow shows new updates - conform to password flow for this

[lastmeta]

this really just means conform to the new design

[lastmeta]

I removed the verification stream thinking we'd use the grace period as a general solution, but that's not the case