Document the 'logins-report-bad' configuration file option

This was accidentally omitted until now.
htmlauth.py: fix code to work if logins-report-bad is not set

This stupid oversight of mine was found by @augmentedfourth