Plug memory leaks in HTTP authorizer
Do not check only the password prefix

(Is strcmp() safe here since the base64 decoder adds a NUL to the decoded
string?)