if username or passwd parameters are empty, dont allow log in