So passing an empty username/password is accepted by the client as “no auth”? From a semantic standpoint I think it makes more sense to just have these be nil if not present…