Do not allow setting ghost password for user without username

src/users.js

@@ -267,6 +267,8 @@ async function setGhost(user, password, expiresAt) {
     assert.strictEqual(typeof password, 'string');
     assert.strictEqual(typeof expiresAt, 'number');
 
+    if (!user.username) throw new BoxError(BoxError.BAD_STATE, 'user has no username yet');
+
     expiresAt = expiresAt || (Date.now() + DEFAULT_GHOST_LIFETIME);
 
     debug(`setGhost: ${user.username} expiresAt ${expiresAt}`);