Non SSH image:

RO user
RW secure

SSH image:

RO userpasswd
RW securepasswd

After upgrading from non-secure image the non SSH defaults apply!