Password with empty string causes failure w/out actually authenticating

When trying to login with the following credentials
User: 'Admin'
Pass: ''
a new BadRequestError is being returned.

The authenticate fails in /passport-local/lib/passport-local/strategy.js
Strategy.prototype.authenticate = function(req, options) { ...
var password = lookup(req.body, this._passwordField) || lookup(req.query, this._passwordField);

In this example, the logical OR is doing
password = '' || null
With the way JavaScript works, the OR is returning the last value, which in this case is null

An empty string password should be allowed

Start in passport-local/lib/passport-local/strategy.js at Strategy.prototype.authenticate and reproduce the Admin login with an empty password. Trace how the password is selected from the request, then verify the completed behavior no longer returns the reported BadRequestError for an empty-string password.

Written by the indexing model from the issue text.