default password can be exploited if not changed

[rayjanwilson]

with the current implementation, if a user doesn't change the default password, then it can be exploited. turns out the default password isn't needed because if removed it will force the end user to create the password, which is the behavior desired.