This avoids double frees of bnctx and related crashes.
This adds an initial EAP-pwd (RFC 5931) implementation. For now, this requires OpenSSL.