Separate the init password role

it's a bit intricate because we break the existing way to establish ssh
connection half-way through the playbook, so we have to reset
connections.