Check for None password field on user

Forgot to handle the case where users signed up with Facebook has `None` set for their `password` field