In oils_auth.c: changed the treatment of inactive accounts.

In oils_auth.c: changed the treatment of inactive accounts.

Previously, if someone tried to log on to an inactive account,
the error message reported to the client would identify the
account as inactive, without regard to the password.

Now the message identifies the account as inactive only if the
password matches.  Otherwise it reports it simply as a failure.

Also: changed the barcode to a pointer to const, pointing to
an existing string, rather than allocating a separate copy
that we have to free later.

Also: tinkered with a couple of info messages to avoid
invoking undefined behavior when barcode is NULL.

git-svn-id: svn://svn.open-ils.org/ILS/trunk@13623 dcc99617-32d9-48b4-a31d-7c20da2025e4