moved check for nonempty password to a proper place