fixed bug where strtok() could return NULL in getpassf().