act_headless should create accounts in disabled state

When an account is created via act_headless, if there is a consumer running there is the chance that the given service might see the account creation and it will try to authenticate against it before the correct credentials are setup or before the handshake is complete.

A good way around this problem is to make sure that no services try to authenticate against the account before the user explicitly enables it after an initial credential authentication.