disallow null passwords (geez I fixed this long ago, where'd it go?)