bug fix where empty password bipassed authentication