Deny authentication for blank passwords

* test against BCrypt to catch bugs
* remove fake password strategy
* resolves #303

Note on removing `PasswordStrategies::Fake`:

I've benchmarked the existing (master branch) suite, vs this one, and the times were comparable. I'm not sure that there is a speed issue here, and testing against the actual `BCrypt` strategy yields situations that are closer to real world usage.

Running just the rspecs (via `time (rspec)`), shows that master brach is 0.2 seconds faster for all the rspecs.