Make 'verify-credentials handle nonexistent users

'get-role-pasword now simply returns 'nil when given 'nil for 'role-id

'verify-credentials now checks whether 'get-role-password actually
returned anything, before trying to verify it.

Still doing it wrong, but at least now doing it wrong, correctly.
Fixes #36