Existing SSO accounts have no local password, so the migration deactivates them before dropping is_sso_user and the identity_provider_user table.
Closes #627, closes #1047