Add function to pass sessions_controller test to see if blank password is submitted, and if it is, assign user.code and user.expires_at