Can log in with blank password

[icydee]

With new accounts it is possible to log in with a blank password.

To reproduce

1. Register with a new username and email address
2. Go to login screen, enter username but leave password blank.
3. Login is successful

This is because when the user account is created it has a blank password.

To fix. Create a random password in the registration process

[aa153]

maybe force new player to create password when he registers?

[dmcbride]

Creating a random password and emailing it to them is both more secure and ensures that the email address is valid. It's more secure partly because we've already written it down for them - they can change it later, but if they forget, it's in their inbox. And then if they still forget, we definitely can email them a replacement key.