improve authentication logic for empty password

- Move empty password check from httpLogin to httpAuth
- httpLogin now only validates actual password comparison
- httpAuth handles empty password as authentication bypass
- This ensures consistent authentication behavior across all endpoints

Previously, empty password would always return true in httpLogin,
now it's properly handled at the authentication middleware level.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

api.go

@@ -351,7 +351,7 @@ func callUserHookUrl(cfg *Config, c *gin.Context) bool {
 }
 
 func httpLogin(cfg *Config, password string) bool {
-	return cfg.Password == "" || cfg.Password == password
+	return cfg.Password == password
 }
 
 func isLocalRequest(c *gin.Context) bool {
@@ -364,6 +364,10 @@ func httpAuth(cfg *Config, c *gin.Context) bool {
 		return true
 	}
 
+	if cfg.Password == "" {
+		return true
+	}
+
 	sid, err := c.Cookie("sid")
 	if err != nil || !httpSessions.Exists(sid) {
 		return false