disallow empty password