Set retval in the empty password case to avoid a path through the
code that fails to set retval before falling through to the final
return().

Reported by: emaste
Reported by: Coverity
CID: 1018711
MFC after: 1 week