checkLogin could throw a NPE for externally authenticated users (LDAP)
that have no password set