Use validation callback for "authorize" sections

Move the check whether a password was specified from hash_auth_blocks()
into a validation callback function.