Not able to login after attempting without user name

[kpdecker]

When attempting basic auth, if the user does not enter a user name they will never be able to log in under chrome as the 400 response does not appear to invalidate the entered credentials for Chrome.

I haven't had a chance to read into the spec to see what the defined behavior should be but this seems like a case that we should make chrome happy even if it's interpretation of the spec is incorrect.

Also it seems like there is value to being able to enter the empty string for the basic auth username so perhaps the framework should not validate this and leave it to the validateFunc to manage.

[hueniverse]

Added a flag for Basic allowEmptyUsername which is false by default as the safer option.

[kpdecker]

What is the new response code if the user enters empty and it's rejected?

[hueniverse]

It's 400 but should be changed to 401. I'll open an issue.