Fix regression in has_secure_password.

If the confirmation was blank, but the password wasn't, it would still save.

Sent via a PR for feedback. Password stuff is tricky.

/cc @josevalim, @senny