Turn off user validation on login

A follow up PR to #3688, this is a bit more heavy-duty, as it disables validation during the login check entirely.

This means the values are saved, but has the potential to save invalid values.  However, in both of these cases, we are setting explicit properties. 

In future we'll want to update our validation to only validate the values that are actually passed. This will be a necessary part of adding PATCH support, but I think is too much for 0.5.

issue #3658

- prevent validation from occuring when we're only logging in