handle empty passwords