If there is no password, refuse access rather than blowing up.
Merge bug25535
stable to default
Merge heads