Specifying

rootpw --iscrypted <crypted string>

in a kickstart file now results in an empty password field for root in
/etc/shadow, thus allowing unauthenticated access when the kickstarted
system first comes up.  I have replicated this condition twice now.