set_password delayed update

If user tried to login with invalid username,
django/contrib/auth/backends.py calls:

UserModel().set_password(password)

This is to reduce the change an attacker could guess if user exists or
not based on timing the login calls.

It expects this not to save anything, as set_password() is suppose to
require a another call to save() to do the actual save.

We had not implemented this correctly, and set_password tried to save()
the new password immediately, resulting in errors because required
attributes have not been set for this dummy user.

This is now fixed, so the password does not get written until save() is
called.

Unfortunately this does not prevent the timing attack that the Django
implementation was trying to avoid, as external data stores need to be
updated and commited at the same time.

Change-Id: I091dad94a8f6d91a0203ddea6314e3447f239d68