Allow empty password auth header with test.