In particular, make hba.c cope with zero-length tokens, which it never did properly before. Also, enforce rolcanlogin.
