Use an empty challenge for the password question

Use an empty challenge for the password question

If a question's challenge is NULL, it is unnecessarily difficult for a
responder callback to detect whether it was asked.  So it's better to
use an empty challenge when there is no challenge data to communicate.
Do this for the "password" question.

ticket: 7499 (new)
target_version: 1.11
tags: pullup