Only automatically include validations when they are enabled on `has_secure_password`

This is a follow up to #16024.
This test should not be using the `@user` instance?