auth: Don't crash if UserList contains bogus line