Internal authN backend: make it impossible to successfully log in with a blank password (for 3.6.x)

[michaelklishin]

Proposed Changes

This disables logins with a blank provided password in the internal authN backend. There should be no reason to use passwordless users
and password-based authentication (the PLAIN authentication mechanism). Blank passwords
are only useful when they are, ahem, not used because authentication is handled out of band, e.g. via x509 certificates.

It is still possible to create a user with a blank password or clear a password on an existing user.
When the EXTERNAL authentication mechanism is used, the internal backend is not involved at all.

Note that this change is limited to the internal backend only. External backends such as LDAP
are considered to not be controlled by the broker.

Types of Changes

What types of changes does your code introduce to this project?
Put an x in the boxes that apply

• Bug fix
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation (correction or otherwise): Document passwordless users and their upcoming limitations in 3.7.3 rabbitmq-website#472
• Cosmetics (whitespace, appearance)

Checklist

• I have read the CONTRIBUTING.md document
• I have signed the CA (see https://cla.pivotal.io/sign/rabbitmq)
• All tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• Any dependent changes have been merged and published in related repositories

Further Comments

[#153435857]

[gerhard]

Works as expected.

Did you mean to have the error message display on 3 separate lines or 1 line?

[michaelklishin]

The message will be a single line in the log even if it's a multi-line Erlang string. In other words, they are actually concatenated by erlc.