Deduplicate and extract user/password extraction from alternative HTTP headers logic.

The previous solution was not good because it is hard to see that there is no difference between the two blocks. This is now clear because we are iterating over a list of variable names. The variable name for the list can be kept short because the logic was also extracted into its own function.

Refs #9310