If a password is not provided (or blank), use the user's default out-of-band factor. This makes it possible to use the 'auth-user-pass-optional' server directive.