When user accounts are created by either email invitation or by facebook
login, the user doesn't supply a username or password, so we have to
generate one on the fly.

We used to generate both if it was determined that a username needed to
be generated.

We decoupled the generation of the password.  Now, we only look to see
if the user has a password, and if not, we generate one by hashing the
username