If password is unset, set it to empty string -- use ==