now accepting empty passwords for basic header