split management daemon authorization from authentication and use 'doveadm pw' rather than 'doveadm auth test' so that it is decoupled from dovecot's login mechanism

This was done to pave the way for two-factor authentication, but that's still a ways off.