http: http.emptyauth should allow empty (not just NULL) usernames