len must be signed

Avoids wrapping if data doesn't contain a ':'
This avoids an out of memory exception when receiving malformed auth data
Use initWithBytes instead of initWithBytesNocopy

For some strange reason, the dest pointer gets mangled by gnustep
when the init fails with encoding:NSUTF8StringEncoding.
Use initWithBytes and free the pointer manually instead.

This avoids a double free crash when handling latin1 encoded creds
use initWithBytes to handle credentials

That behavior matches what stringByDecodingBase64 does, but this code should
probably be rewritten to use it instead on rolling its own version.
Merge branch 'fix/2358'