Your Login Code Assumes Every User Has a Password

Look at your users table. There is probably a column called password hash. It is probably not...