Modify identity selection logic / fix bugs

Modify identity selection logic / fix bugs

If the request provides an password, always use it.
If the request provides an nai, but no corresponding identity exist,
create a temporary identity which is never stored to handle the response.