libunftp accepts successive PASS commands

[robklg]

This is not in accordance with RFC 959:

    PASSWORD (PASS)

       The argument field is a Telnet string specifying the user's
       password.  This command must be immediately preceded by the
       user name command, and, for some sites, completes the user's
       identification for access control.  Since password
       information is quite sensitive, it is desirable in general
       to "mask" it or suppress typeout.  It appears that the
       server has no foolproof way to achieve this.  It is
       therefore the responsibility of the user-FTP process to hide
       the sensitive password information.

("This command must be immediately preceded by the user name command")

[hannesdejager]

Fix available in v0.18.0