fix(auth) blank password results in inability to authenticate

Found myself in a vicious loop if I failed to type in a password when prompted in Chrome. Every refresh of the page would fall into the criton check with a blank password. Seems Chrome wouldn't clear the headers until I closed the browser and/or switched to a new incognito tab. Probably a user error, but still, this avoided the criton throw.

lib/server/auth.js

@@ -29,14 +29,18 @@
     }
     
     function check(username, password, callback) {
-        var sameName,
+        var BAD_CREDENTIALS = false,
+            sameName,
             samePass,
             name    = config('username'),
             pass    = config('password'),
             algo    = config('algo');
         
-        sameName    = username === name;
-        samePass    = pass === criton(password, algo);
+        if (!password)
+            return callback(BAD_CREDENTIALS);
+        
+        sameName = username === name;
+        samePass = pass === criton(password, algo);
         
         callback(sameName && samePass);
     }