Login was working for zero-length passwords!