Don't reveal whether password is <20 or >20 characters in RPC

As discussed on IRC.

It seems bad to base a decision to delay based on the password length,
as it leaks a small amount of information.
Merge pull request #4728 from laanwj/2014_08_rpcserver_password_delay

Don't reveal whether password is <20 or >20 characters in RPC