Password should default to undef, not an empty string