HttpAuthentication: improvements and fixes

 * BString::CopyInfo() takes length as second
   parameter, not the end-offset. This bug didn't
   have any effect, since BString clamps the length.
 * ',' is a comma, ':' is a colon.
 * When parsing "additionalData" in the loop for
   name=value pairs, an empty name is not useful,
   continue the loop early.
 * "value" may have the length 0, accessing it
   with value[0] would not lead to an access violation,
   since it just reads the terminating zero (I think),
   but it's nicer if the code makes it clear that
   value being empty is considered.
 * _H() was using a static buffer, in a heavily
   multi-threaded situation. I don't think this was
   healthy.
 * Implement the proposed optimization of using
   BString::LockBuffer(). Appending one char at a time
   is really bad for peformance. The Base64 encoding/decoding
   should really be rewritten as well for similar reasons.