sync with my merged debian cryptsetup upstream version
better handling of invalid passwords