Allow basic auth with empty username

[ulrichsg]

I am developing a service right now that is explicitly required to use basic auth while only checking the password, not the username. So I tried setting the username to "", but that does not work with the current implementation of HttpBasicAuth. This patch enables it.