don't attempt to verify against an unset password hash

This also fixes a corner case where an LDAP bind would be attempted even
if the supplied password had already failed verification against the
Beaker password hash. This situation should normally never happen, but
in case it does, the password set in Beaker should take precedence over
the LDAP password.

Bug: 1072127
Change-Id: I77acfddab494db4eaee286bcdf47d620d7cb4909