[core] allow empty passwords (disabled accounts)