Make it explicit that the objects weren't saved

Previously, the fields supplied in the where conditions were enough to create
these objects.

Now, though, additional validations mean that they aren't valid.

From a functional perspective, the code still did what was intended: it saved a
new record, but only thanks to the later call to `save!`.

By using `first_or_initialize` it is clear that the object isn't yet saved. It
should also save a database write if the record doesn't exist yet.