no password if blank