updated code to not use an unsaved User model instance within a password-only Voter, as that is considered unsafe in Django 1.8
