Only automatically include validations when they are enabled on `has_secure_password`

This is a follow up to #16024.