proper handling of null passwords