Backport has_secure_password fix from #11107

This bug breaks Rails 3 behavior that is noticeable for upgrading apps. I think it should be backported into the next Rails 4.0 release. I have reapplied all changes onto 4-0-stable, all tests are passing.