Empty passwords should not be allowed. Maybe it also makes sense to require them to be of a certain minimum length.