bugfix: password can't be blank