Finally fixed authentication so it looks like I know what I am doing:
* password is not set as "null" during signup
* password is not set to "null" during login checks, leading to any password being accepted for any account.