Support legacy non-HMACed non-plaintext password

Try passwords first HMACed, then fallback to sans-HMAC if that fails, in order to support legacy encrypted passwords.