Send auth notifications to *all* admins
Bug fix: authorization of users with passwords

Found a bug in QAing the app - users who created their accounts with
a password instead of an OpenID url couldn't be authorized (or
rejected).  Turns out these users had blank strings for their OpenID
urls, which didn't validate on the next update of the record.

Fixed by: ensuring blank OpenID strings are nulled.