has_secure_password shouldn't validate password_digest.  It should also take options to turn validations off.