Not setting FIRST_USER_PASS is not possible (for the wrong reason)?

[aWeinzierl]

README.md says:

• FIRST_USER_PASS (Default: unset)

  Password for the first user. If unset, the account is locked.

However, when I enable DISABLE_FIRST_BOOT_USER_RENAME while not setting FIRST_USER_PASS, it says:

Not setting FIRST_USER_PASS makes your system vulnerable and open to cyberattacks

This doesn't make any sense to me, since disabling login via password (which is what locking the account actually seems to mean in the context of this project - however even if the account would actually be locked, I don't see any vulnerability) should only increase the security of the system.

Proposal:

• Update README.md to accurately describe what happens
• Update build.sh to mention the actual reason for requiring a password
• Ideally: Support omitting the password to allow generating an image with access by public key authentication via ssh only.