When users with no password set try to login, this should be refused.

It was not possible to login but because of an error (pw_validate does
not support to be called with None). The error was catched by PAS and
logged with level debug, so we did not notice.

These changes are mostly about covering this in a test to make sure this
does not regress and we also change the code not to raise the error.