Deduplicate and extract "user/password extraction from alternative HTTP headers" logic.

The previous solution was bad because it is hard to see that there is no difference between the two blocks.

Refs #9310