@kjohnston this is a regression: If both `password` and `password_confirmation` are `nil`, no password will be required.