Modify identity selection logic / fix bugs

If the request provides an password, always use it.
If the request provides an nai, but no corresponding identity exist,
create a temporary identity which is never stored to handle the response.
Fix identity duplication bug

Occured when 'send'ing an identity w/o a password.