Check code/securecode are set for login

Fixes #31.

If securecode is NULL (e.g. bad external log-in code) then any user from the
same IP can gain access if they don't have a securecode cookie set.

perl_lib/EPrints/DataObj/LoginTicket.pm

@@ -150,19 +150,23 @@ sub new_from_request
 			$r,
 			$SECURE_SESSION_KEY
 		);
-		$ticket = $dataset->search(filters => [
-			{ meta_fields => [qw( securecode )], value => $securecode },
-		])->item( 0 );
+		if (EPrints::Utils::is_set($securecode)) {
+			$ticket = $dataset->search(filters => [
+				{ meta_fields => [qw( securecode )], value => $securecode },
+			])->item( 0 );
+		}
 	}
 	else
 	{
 		my $code = EPrints::Apache::AnApache::cookie(
 			$r,
 			$SESSION_KEY
 		);
-		$ticket = $dataset->search(filters => [
-			{ meta_fields => [qw( code )], value => $code },
-		])->item( 0 );
+		if (EPrints::Utils::is_set($code)) {
+			$ticket = $dataset->search(filters => [
+				{ meta_fields => [qw( code )], value => $code },
+			])->item( 0 );
+		}
 	}
 
 	my $timeout = $repo->config( "user_session_timeout" );