Most places that check for the presence / absence of credentials compare
them against `undefined`, except the one for Plain authentication.
This change makes the very last place to use the same pattern (instead
of checking for falsiness) for consistency. Additionally, there are ways
to configure PAM to accept empty passwords, so it's possible for a user
to legitimately send an empty string as password.
0c55c64757