WL-2372 Duplicate detection failed when no userId.

When the userId wasn't passed in (e.g. creating an external signup) the duplicate detection was using a null userId which never matched and so allowed the user to create duplicate signups for the same user.