This doesn't pertain to the PR directly, but I'm a little confused by the fact that there is a specific check for `username` to be the empty string but a general check for `password`. What happens, for instance, if `username` is `None` while password is some nonzero string? Is that something we want to look out for as well?