security: deny login via empty password