Add option to accept empty password in BasicStrategy

Accept empty passwords (i.e. ```userid:``` instead of  ```userid:password```) by passing a new option, ```{ acceptEmptyPassword: true }```, when creating the strategy.

This is useful for implementing an API that only requires a secret key as the username (example: [Stripe's API authentication](https://stripe.com/docs/api/curl#authentication)). Instead of failing with a ```400 Bad Request```, Passport will now let the verify callback decide how to handle the empty password.

The IETF spec wasn't clear for me on whether an empty password is allowed or not, so when the option is not explicitly set to true I kept the previous behavior (400).

Would be happy to make this the default and remove the option though, if there are no side effects I'm not seeing :)