When setting a blank password, use webserver.api.password instead of webserver.api.pwhash

[PromoFaux]

What does this PR aim to accomplish?:

Per title, uses the correct config item to set an empty password (rather than forcible clearing out the hash)

This also prevents the password from being set to empty when someone has already set it to a value with FTLCONF_webserver_api_password

Without environment variable set:

With environment variable set:

---

By submitting this pull request, I confirm the following:

1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
2. I have commented my proposed changes within the code and I have tested my changes.
3. I am willing to help maintain this change if there are issues with it later.
4. It is compatible with the EUPL 1.2 license
5. I have squashed any insignificant commits. (git rebase)

---

• I have read the above and my PR is ready for review. Check this box to confirm