Backporting fix for #248

As suggested by @bakura10, this fix removes the security hole by preventing automatic type casting from affecting authentication via zero password
Merge remote-tracking branch 'upstream/0.7.x-dev' into develop