#8: empty password case