mit-kdb: Restrict admin/changepw principal db_entry with some flags