only validate password when present