ask-password-api: don't accidentally create a dir, when we don't want one

ask-password-api: don't accidentally create a dir, when we don't want one

Previously, we were using touch(), which usually works fine, because the
path should always refer to an existing directory, in which case it just
updates the timestamp. However, if the dir does not exist yet (which
shouldn't happen), it would be created as regular file, which is just
wrong.

Hence, let's instead create the dir as dir if it is missing, and then
update its timestamp.