Ability to allow/block use of local credentials for Google linked accounts

Being able to link a OnDemand account to Google is really useful from an SSO perspective but the full benefits come when you can flow through deactivation of the account. The ability of users with Google linked account to still create an OnDemand password, while necessary for some features (as discussed at https://confluence.atlassian.com/display/AOD/Managing+users+and+groups+with+Google+Apps#ManagingusersandgroupswithGoogleApps-PasswordsandGoogleApps), isn't likely to be required by all users.

2 Feature requests:

• there should be a mechanism to indicate that certain user accounts can/can't (I would have a preference for "can" but understand that would potentially break existing configs) use an OnDemand passwords.
• there should be a mechanism such that when the Google credentials are deactivated, any OnDemand password can no longer be used.
• there should be a mechanism to search for users that have a OnDemand password
• there should be a mechanism to remove a user's OnDemand password
• there should be a mechanism to indicate when a user account last logged in with Google SSO and with OnDemand password