Tried to see if this would work. Unfortunately, we modify the `@user` object in the before block, and `authenticate` will create its own instance of `user` (fetched from db), and our modification of `password_optional?` gets lost.