Have require_fresh_login not apply if there is no password set for the user

endpoints/api/__init__.py

@@ -285,7 +285,7 @@ def require_fresh_login(func):
     last_login = session.get('login_time', datetime.datetime.min)
     valid_span = datetime.datetime.now() - datetime.timedelta(minutes=10)
 
-    if last_login >= valid_span:
+    if not user.password_hash or last_login >= valid_span:
       return func(*args, **kwargs)
     
     raise FreshLoginRequired()