Refactor user.password_required? and fix bug