core: keep the password only if the user part is set

- a report by Timo Klecker