prevent auth with blank credentials