Allow GUEST user to pass authentication request without a password.

If no password is set for GUEST user, allow a client
to authenticate to GUEST.

For all other users, no password means that it's only possible to become
such user with session.su() or inside a setuid function.

The exception for GUEST user is useful for connection
pooling, where we would like to "reset" a connection to its
default, non-authenticated state, when returning it to the pool.