Support userid only fixes #9

How do you define "malformed"? There is no validation of the base64 format, and the buffer doesn't really care, so nothing really is "malformed". It's just a type of bad credentials.
If you can describe what should be considered malformed, and whether we really want to syntax check using a regex, then I'll happily implement and test.