it's okay to set the password digest even if password is blank