Fixes an APOP authentication vulnerability (CVE-2007-1558). ok bernd@
From ray@ (snapshot), applied to stable and tested by me. Feedback from wilfried@ and (via ray@) moritz@. ok moritz@ steven@