sync with OpenBSD tree: cvsid + latest commits from eric@ sthen@ chl@ deraadt@
- add support for local deliveries through LMTP
  code from Ashish SHUKLA
- introduce a random pause before telling a client that we rejected his password in order to avoid a possible timing attack.
  the attack would not be very accurate and would barely recover the salt before requiring too many resources to be viable but still, it doesn't cost to protect against it.

issue reported by Jason A. Donenfeld
typo in trace message
- do not leak credentials in the logs when authentication fails