deal with password-less users