empty strings are not committed as null values in password input. They need to be checked for empty string as well.
Some body annotations fixed for future versions.