Corrected: if a password isn't changed, it would have been set to empty