And if the user somehow sets a blank password by some other means? I password complexity enforcement of any kind on login is a bad idea, IMHO.