test USER and PASS commands

update dev dependencies
reject non-secure USER when tlsOnly
reject invalid username
reject invalid password
reject PASS without USER

fix asylumfunk#24
fix asylumfunk#25
remove unreachable branch