s3-samr: never allow to alter pwdlastset directly.