(PUP-2738) Ensure block in user.password_is?

This ensures that a block is given by password_is? when calling
logon_user even though it doesn't need to do anything with it. We went this
route because it made more sense to require a block for this call versus
checking if a block was given in the logon_user method. If you call
logon_user without passing a block you cannot take the next step to later do
something as that user. So it would be a misleading if we allowed it without
requiring a block.
Yes, we had a lengthy discussion on this and I captured some of it in the commit message. We want a block to be given. Logon_user is almost useless without it.

We don't want to give the impression that 

```ruby
user_token = logon_user(somebody,somepassword)
#load that users's profile or set up impersonation
#do something as that person
```
would ever be valid given not having a block.