add flag (disabled) to exercise SRP validation bug

If the server doesn't check that A%N!=0, attackers can trivially connect
to the account without knowing the password. In mysrp.py, setting
exercise_validation_bug=True performs this sort of attack.