fail probably down to empty() password. user created on first oauth login now sets an invalid hash.