Fix reading of plain auth input

Also added some more test cases. The old code, in addition not correctly
handling the case where there was an authzid, would also behave badly on
improperly constructed (or malicious) input.

Change-Id: I561109d40eee6a16476e0f46765f84600233ded9
Reviewed-on: http://review.couchbase.org/28314
Reviewed-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>
Tested-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>