has_secure_password already validates the presence of password. We don't have to do it twice