Fix regression in has_secure_password.

If the confirmation was blank, but the password wasn't, it would still save.
Merge pull request #10694 from steveklabnik/hsp_regression

Fix regression in has_secure_password.