fixed bug where passwords are stored in plaintext

first fix:
https://bugs.launchpad.net/fuel/+bug/1361796
since password hashing was moved out of on_before_clean and into on_before_save, and in on_before_clean new_password gets set back to password, this should be reflected in on_before_save

without this fix logins will never validate for those new users and -the password is stored as plaintext!-

second fix:
stopped PHP from throwing "undefined variable"
since the logic statement above uses or, there are times when $has_uri is unset
using (!empty($has_uri)) instead of ($has_uri) prevents PHP throwing an error/warning