[#6701] Don't send usernames and passwords in the URI (ends up in logs)

Signed-off-by: Cory Johns <cjohns@slashdotmedia.com>
[#6701] [fixup] Added logging for auth due to missing username

Signed-off-by: Cory Johns <cjohns@slashdotmedia.com>
[#6701] Must call get_basic_auth_pw before req.user

Signed-off-by: Cory Johns <cjohns@slashdotmedia.com>