[SECURITY] Disallow login with empty password