The `password_optional?` field was intended for alternate forms of authentication (ie oauth), where users would never have passwords. In those cases, signing in with an email/password should always fail. With this change, I think you'd be able to sign in as oauth users by just guessing their email.