don't allow empty password to authenticate

Leaving the password blank would allow any user to login with any username. Added a check for empty password. Includes working spec.