--- a/plugins/mod_legacyauth.lua	Sun Aug 05 17:21:19 2012 +0100
+++ b/plugins/mod_legacyauth.lua	Tue Aug 07 17:00:12 2012 +0200
@@ -58,6 +58,10 @@
 		username = nodeprep(username);
 		resource = resourceprep(resource)
 		local reply = st.reply(stanza);
+		if not (username and resource) then
+			session.send(st.error_reply(stanza, "modify", "bad-request"));
+			return true;
+		end
 		if usermanager.test_password(username, session.host, password) then
 			-- Authentication successful!
 			local success, err = sessionmanager.make_authenticated(session, username);