Good catch.  Here's an updated patch to fix the missing decref in
_pwinfo_set()

The length check in _password_callback() applies to both callback
functions and predefined strings.  The C API always uses a callback,
so _password_callback() is used even when the python caller has passed
in a string.  We can't check the length in _pwinfo_set() since it depends
on the buffer length argument that openssl will pass to
_password_callback().