possible crash case fixed in command auth

make sure the error message buffer is blank before starting as old data could
trip up a later client.   Prevent an authenticating client from trying a 403
respsonse and then a 302 response.