Microsoft nudges enterprise security closer to its passwordless future. But ‘123456’ will survive.