TestCase.create_user() was unconditionally setting a user's password,

but if a password wasn't provided, the end result wasn't really correct.

We ran into this on RBCommons and fixed it there, but this fix is worth

backporting to Review Board.
This change simply makes the set_password() call conditional on

whether a password was provided.

Unit tests passed.