I agree it's a security issue waiting to happen in a future code change.
I'd strongly prefer a different solution here, ie one where the password is
set to empty in the testing code instead of bypassing the check.