Remove password field requirement for /users/{id} endpoints

[rbassot]

• serializer is updated to accept AppUser data with both a password and a lack of a password
• views logic updated for CREATE /users to assert that a password field does exist (required to create a Prof account)
• update the UPDATE /users/{id} test to send password-less data