In commit 89a17f04, disabling password
verification when passing an empty password was a bad idea, since it
wasn't possible to check fully the login form itself. Some tests broke
because of this change.

There was also a stupid mistake: `pw_validate` could call itself
instead of the original function.