Revise password requirement logic

* Continues to only require password when provider
is identity.

* Continues to require password fields be 
completed during password reset process.

* Bases password requirement on assignment of
password or password_confirmation values rather
than on blankness of password reset token, fixing
issue where Identity#verify! was failing to save
because password values were being expected.

Closes #39