users null should be considered wrong password