* sensor: login with blank password now just checks if sender is in ACL, and returns permissions (if so)