for this user not activated, there no correct password exist, so don't bother ask for it and return "" immediately