empty password or invalid password