[STROM-482] (Security) DefaultHttpCredentialsPlugin does not handle no credential properly