Fixes password checking and user creation bugs.

Bad interaction between 3 coders, and a lack of testing across at least 2 of us :)

This solves a number of issues.

Testing:
* none needed; @aronasorman 's automated tests would have worked... if they had been run :)

@aronasorman - could you review the changes?