allow authenticating user without password if explicit request
Merge pull request #3 from FoundersAS/develop

allow authenticating user without password if explicit request