membership authentication ignores blank passwords or usernames and fails automatically