If these aren't empty, only then check if user authenticates with password $password. Merge with above if case. No need to check if $password is empty.