Validate unique + allow_nil + has_secure_password

- Addresses #371