Major Security Hole

It is possible to login with just a username and a blank / empty password, because you check for a password before hashing it.  If the password is equal to '', was skipping the password hash all together, and just returning the user it found by username conditions only. This was found on a live production site, that you could login with a username only.