add a dumb backend and fix empty password handling