Fix attempts to log in without a password, or without confirming your email

I was experimenting with inviting users by email address when I noticed that if users try to log in when they don't have a password set, it crashes.  I also noticed that while login_without_confirmation allows you to pass through to the logged in state during signup, it doesn't actually allow you to log in.