If you don't enter a user, $login{$user} will return undef which is eq to $pass if no value was entered as a password. So the condition to grant access holds.

Check whether both user and password are entered (defined $user && $user ne "", similar for user) and check whether exists $login{$user} to see whether the user is supposed to have access at all.

Hope this helps, -gjb-