users auth: Fix harmless PHP warning on login (#848)

"Undefined variable: user"

PasswordHash doesn't need to know $user->password_iterations when checking
passwords, so we can just get rid of it.  (The saved hash already includes
this information).