Extend the "don't overwrite fields if only carriage return is entered" to password field

And also use malloc. What I'd done before wasn't doing what I thought. C
newbie and all that. It must have picked up whatever `input` was
initialised at, which must be one of STRING_SHORT, STRING_MEDIUM, etc.
So it was just by luck it was working. It could have ended up truncating
strings I guess?

I'm in two minds about the benefit of dynamic allocation though. Since
this is hardly a big memory hungry application I could probably just
set `oldinput` to the largest possible string length and it'd be fine.