buf2radmsg() is never called with rqauth != NULL and secret == NULL
but let's protect against future callers.

coverity: 1449519