The password field should be required in the sign-up form; currently, you can sign up without filling in a password, but then, because you don't have a password, you can never sign in.