better passwordless handling (thanks @justinvdm)