If you create a patron without a card number (null) and try to validate their credentials using auth/password/validation, the request will fail. Error message : Expected string - got null. The failing point isn't the validation but the return values that Koha tries to send back in Auth/Password.pm. We simply need to send: cardnumber || "", for it to work again.