Update routes/user.js

So basically this should stop the registration from creating a user with an empty password despite showing an error stating otherwise. I think. I'm not sure because I didn't test it.