This solution seems to do what I want:
In forms.py
,
from flask.ext.wtf import Optional
def make_optional(field):
field.validators.insert(0, Optional())
#Rest of code here...
Then inside my flask endpoint I can call:
user_form = UserForm()
forms.make_optional(user_form.password)
if user_form.validate_on_submit():
#Go on your merry way!
That seems to do what I wanted - keep all the other validation (e.g. confirmation), while ignoring anything if there is no password present.