[SECURITY] Users can login with empty passwords

Fixes: #63966
Change-Id: I4c9e5999d15fc897c7e12ded30bca749b331e0d5
Reviewed-on: http://review.typo3.org/35584
Reviewed-by: Xavier Perseguers <xavier@typo3.org>
Tested-by: Xavier Perseguers <xavier@typo3.org>