don't auth with empty password