CVE-2017-11365: Empty passwords validation issue

Validating a user password with a UserPassword constraint but with no NotBlank constraint passes without any error (the empty password would not be compared with the user password). Note that you should always be explicit and add a NotBlank constraint, but as it worked before without, it’s considered as a backward compatibility break and a security issue.