Allow for empty HTTP passwords

As best I can tell, an empty password is valid in HTTP authentication, so this change removes the check for an empty `PHP_AUTH_USER`.

Longer story: in our environment, the web server doesn't create the `PHP_AUTH_*` variables, only `REMOTE_USER`. The simplest way to get things working was to make this tweak and to assign `REMOTE_USER` to `PHP_AUTH_USER` in `local.protected.php`.

Thanks for your work regarding the new authentication system!