any number of *s counts as a null password