The Add User page allows users with blank passwords, but the user cannot log in.

Currently JIRA seems to allow an administrator to create a User with a blank password.
However, that user is not able to log in with the blank password.
Furthermore, if you attempt to change the password on an existing user, there is validation that does not allow a blank password to be entered.

This leads me to believe that the Add User page should also validate against blank passwords