Return `WP_Error` when user is invalid

We're checking for `WP_Error` in more places than falsy