move User-Password warning from auth.c to rlm_pap