Correctly validate bcrypt and md5-hashed pincodes

I was annoyed to find out that because of a faulty logic in test.py, a
subset of tests never actually ran. Otherwise we would have discovered
that bcrypt and md5 hashes aren't validated properly (see issue #21).

Another test that was failing was the highly unlikely corner-case of
someone using a two-digit pincode together with a 6-digit tokencode
(e.g. if for some bizarre reason your password/pincode is something like
"99" and therefore we first try it as an 8-digit scratchcode). This very
unlikely corner case is now fixed.

There are no security implications with either of these two bugs -- in
both cases we were failing securely (by denying an otherwise valid
authentication attempt).