Stricten the AUTH package format for GUEST user.

If no password is set for GUEST user, the authentication
request must not contain auth data, only user name.