Ensure username is not included in the password.

Make sure username+"1234" is not accepted as password, as
these are easy to break.

Unfortunately, this requires API changes, as username was not
previously passed through to validate_password.

We also make sure we don't call assert_strong_password with password of
None, which is kind of meaningless.

Change-Id: Ia544a96fdf2147d4d2171f2ec74d5e4fd76d084b