allow blank password for group auth