added a check for empty username & password to the server. Added password confirmation check to the client. In my opinion this is fine as a client-side only check.. after all if the user really wants to go to the length of disabling that check and entering 2 different passwords that won't harm our server, he's the one who doesn't know which one of his passwords is the correct one.