change operations leaks rwd_key setting to server

[stef]

when a client changes a password, a new auth key is derived in case rwd_keys is set to true, if rwd_keys is false the auth key stays the same as only the id and the master key contribute to it, which don't change. and thus a server can learn if a certain record auth key requires the rwd.