It's been ignored since the introduction of deflogin feature
and removal of build-vm specific ROOTPW variable handling;
might be adjusted to mandate this for vm/bare too, have to
think it over.