Debug mode logs and exposes submitted passwords

[Ewa55]

When debug mode is enabled, the plugin writes the raw submitted password to the PHP error log and simultaneously emits it in an HTTP response header (X-auth_basic). Any observer of server logs, CDN access logs, browser developer tools, or a TLS proxy can capture the master password in cleartext.

Two places appear problematic:

1. Debug messages are also sent in the X-auth_basic HTTP response header.
   // auth.php:64 - echoed into every HTTP response when debug=1
   header("X-auth_basic: $msg", false);

2. The submitted password is included in log messages.
   // auth.php:203 - $userpassword is the raw submitted password
   $this->log(FUNCTION . " - is not master password or has been expired: '{$userpassword}'");

Expected behaviour:
Submitted passwords should never be written to logs or response headers.

For example, the log message could simply be:
$this->log(FUNCTION .
' - submitted master password is invalid or has expired');