Only require a password if they have one
Invitation email tweak
Don't reset OAuth users' passwords.  See #1