The use of "||" here and in datebase-upgrade propagation might be problematic.  There's really two issues:
- Will we represent "don't auth" with an empty password?
- Do we think having an empty password is a thing that could happen?

I usually like to see a comment on cases like this and/or a ternary op.