Handle auth without cred

Some clients will send an Authorization header with just the username and realm on it for their first REGISTER.  These are not to be deemed an attempt to respond to a challenge so we shouldn't pass them to pjsip_auth_srv_verify().

This may be useful for distinguishing bono-created Authorization headers too (as bono will never add a response by itself).