I think there's a race here... If two logins happen at once, the first could erase the srp field from the database right before the second login looks up the user record, so the second login could get "User has no password set."

I guess we can fix this by checking if user.services.password.bcrypt is set before throwing "User has no password set", and if bcrypt is set, just do a normal bcrypt login and ignore options.srp.