Anonymous key exchange is not supported currently.

This (partially) enables running TLS over something else than a plain
TCP socket file descriptor.

(demux_Packetizer... could use some factorization with decoder_...)

Shallow fix only, but improved rationalization

 - Never save guest credentials
 - Don't save password in options if it's in the keystore

This reverts commit 76ae877d.

refs toon.avi

avoids failing with delayed start tracks

(otherwise drops packets)