Update to NSS 3.12.8.

nss/mozilla/security/nss/lib/pk11wrap/pk11auth.c

Index: nss/mozilla/security/nss/lib/pk11wrap/pk11auth.c
===================================================================
--- nss/mozilla/security/nss/lib/pk11wrap/pk11auth.c	(revision 61548)
+++ nss/mozilla/security/nss/lib/pk11wrap/pk11auth.c	(working copy)
@@ -164,6 +164,21 @@
 	len = PORT_Strlen(pw);
     }
 
+    /*
+     * If the token does't need a login, don't try to relogin beause the
+     * effect is undefined. It's not clear what it means to check a non-empty
+     * password with such a token, so treat that as an error.
+     */
+    if (!slot->needLogin) {
+        if (len == 0) {
+            rv = SECSuccess;
+        } else {
+            PORT_SetError(SEC_ERROR_BAD_PASSWORD);
+            rv = SECFailure;
+        }
+        return rv;
+    }
+
     /* force a logout */
     PK11_EnterSlotMonitor(slot);
     PK11_GETTAB(slot)->C_Logout(slot->session);