In particular, make hba.c cope with zero-length tokens, which it
never did properly before.  Also, enforce rolcanlogin.