password must not be null