fix client auth for no password

All clients are authorized if the server lacks a password.
mask lists (ban, except, invite)
Merge remote-tracking branch 'origin/master' into user-mask
channel invite mode/list
persist and load channel mask lists