Deny authentication with blank password

* test against BCrypt to catch bugs
* remove fake password strategy