Default external-authentication-uid to null on update

Looks like the last trailing edge - when a user was updaetd via PUT, the value "undefined" was getting captured for ``external_authentication_uid``.  This fixes that.   This also provides consistent behavior with new_record re: recovery-auth-enabled, by forcing the value to true/false.

ping @opscode/server-team