[PasswordAuth] return false when authenticating against empty password