The behavior for how BNLS handles account logins has been changed again.
Since the removal of the requirement of accounts, the behavior has been like this:
If the client sends a valid account name, but a wrong auth password, BNLS lets the client in (and registers an "anonymous" login).
Now, it has changed to:
If the client sends a valid account name, but a wrong auth password, BNLS disconnects the client. Login anonymously in a different way please.
One way to login anonymously is to simply not send BNLS_AUTHORIZE (0x0e), nor BNLS_AUTHORIZEPROOF (0x0f).
This behavior has changed to allow people who still own accounts to disable old bots by changing their auth password, as was possible before.
The documentation of BNLS_AUTHORIZEPROOF (0x0f) has been changed accordingly.
http://yoni.valhallalegends.com/BNLSProtocolSpec.txt
Good call.