If our form only asks for username, but not for password as well, would that be OK?