allow logging in with a certificate only (#493)

...and with password set to an empty string, which denotes that no password shall be asked or sent
allow username to be empty for smartcard login
update man page and readme