Allow empty passwords when parsing Basic authorization header