[HttpFoundation] Basic auth in url is broken when using PHP CGI/FPM

Request#getUser() and Request#getPassword() introduced in
aecfd0a8917370edd237120352749141ffa85362 do not handle the lack of
PHP_AUTH_USER and PHP_AUTH_PW in $this->server when using PHP-FPM. Use
$this->headers instead.
Furthermore, the test of empty password now expects an empty string
instead of NULL according to a450d002f253e32e77d5c2bd3e490435c68a8c09.