do not treat 'Sender:' header as auth info source

- it could be in bounced message (so From, Sender and env sender are equal
  but different from true authenticated sender), only source for auth data
  is 'Received ... (account XXX)' now -- still could be forged, but lets
  hope for the best.
- also: added 'failOpen' directive to example conf file.