Passwords are denied but blank passwords are accepted