authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
CVE-2009-3231
use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
CVE-2005-3435