LdapExtLoginModule breaks if bindCredential is missing

LdapExtLoginModule got changed for SECURITY-422 to allow external commands to be run by prefixing the credential with

{EXT}. It doesn't check for null first which breaks support for anonymous login added in JBAS-3555.

The trivial fix is to change the following line in LdapExtLoginModule.createLdapInitContext()
if (this.bindCredential.startsWith("{EXT}

"))
to
if (this.bindCredential != null && this.bindCredential.startsWith("

{EXT}

"))