> just decline to operate at all until the password is set?

This truly is the right way to handle PSK auth. The "UX" for it isn't as nice as some people would like though.