Allow newlines, CR, and LF in XML from WebKDC to WebLogin

Allow newlines, carriage returns, and tabs in the XML sent from the
WebKDC to the WebLogin server rather than replacing them with periods.
This fixes the display of <user-message> elements that contain
newlines.

Change-Id: Idf03b3a9971bb4ce52e1f537602c7203e9432384
Reviewed-on: https://gerrit.stanford.edu/1543
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Translate KRB5_KDC_UNREACH to WA_PEC_USER_REJECTED

When translating Kerberos errors, treat KRB5_KDC_UNREACH (cannot
contact any KDC for realm) as a user rejected error instead of a
Kerberos error.  This avoids returning an internal error from WebLogin
and instead tells the user the username is invalid.  This is not
always correct, since the unreachable KDC could be the local KDC, but
it's better than the previous behavior of throwing internal errors
when users enter email addresses as their username.

Change-Id: Ie9d60370d6dc0e6878f046301e467d1965a7412b
Reviewed-on: https://gerrit.stanford.edu/1544
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Diagnose empty RT or ST parameters to WebLogin

Diagnose empty RT or ST parameters to WebLogin and return the same
error as when those parameters are missing entirely.

Change-Id: I73d361f734ed56c922d66bc139a5ffa974fd9ad3
Reviewed-on: https://gerrit.stanford.edu/1545
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Translate EINVAL to WA_PEC_LOGIN_FAILED

Translate an EINVAL error from the Kerberos libraries during password
authentication to an incorrect password error code.  Older versions of
MIT Kerberos returned EINVAL for excessively long passwords.

Change-Id: I832b23e782729e3481248ea6299ae92c7a383f00
Reviewed-on: https://gerrit.stanford.edu/1546
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>