Let has_secure_password do its job on BaseUser

Moved validations to the SorceryUser so that has_secure_password can do what we
expect it to do.