Consider empty passwords to be a user error

Programming errors like "the code doesn't try to provide a password"
should throw, but user errors like "the code pulled a password from an
input but it was empty" should use the callback.

Fixes #2272.