Fixes non-object access error when the username does not match a user

Previously, when the `$username` did not match a user, the application password check would run on a null user object and throw warnings.