Turn off user validation on login

A follow up PR to #3688, this is a bit more heavy-duty, as it disables validation during the login check entirely.
This means the values are saved, but has the potential to save invalid values.  However, in both of these cases, we are setting explicit properties. 

In future we'll want to update our validation to only validate the values that are actually passed. This will be a necessary part of adding PATCH support, but I think is too much for 0.5.

I wanted to present this as a separate PR, to determine whether #3688 alone is the right fix for 0.5, or if we decide both are necessary, I'll squash the two things.


issue #3658

- prevent validation from occuring when we're only logging in