Verify a user is valid_for_authentication? during Devise validation

Adds a call to user.valid_for_authentication? to verify that the user is valid for authentication during the Devise validate method.

This change provides support for the lockable Devise model. If valid_for_authentication? is not called, the failed_attempts count and locking hooks are not invoked.

valid_for_authentication? takes a block that is expected to return a boolean indicating where or not the user is valid for authentication. As such I've moved the password verification into the block.