Avoid to report empty username or password when returning
a bad request error response, during user activation.
Unused list comprehension replaced by a normal for cycle