fixed a bug that allowed a user and admin to set blank passwords.