Fixed the logic of detecting login success; fix zp_handle_password

The bug was caused just by the use of `||` instead of `&&`, but in addition, I've resolved the issue that we should never sanitize the password, since the only thing done with it is hashing it to oblivion immediately thereafter. Sanitization could incorrectly dispose of special characters that should be valid in a password.