Require Colon in Basic Auth

[erykwalder]

Going by RFC 2617, it seems that a colon is required in the base64 encoded user-pass.

   To receive authorization, the client sends the userid and password,
   separated by a single colon (":") character, within a base64 [7]
   encoded string in the credentials.

      basic-credentials = base64-user-pass
      base64-user-pass  = <base64 [4] encoding of user-pass, except not limited to 76 char/line>
      user-pass   = userid ":" password
      userid      = *<TEXT excluding ":">
      password    = *TEXT

https://www.ietf.org/rfc/rfc2617.txt

Some servers handle the case of a missing colon, but others do not. For instance, the standard method in Golang for parsing basic auth requires a colon.
http://golang.org/src/net/http/request.go?s=16575:16641#L518

Rather than force users to specify an empty string, it would be preferable to treat an undefined password as an empty string.

[simov]

Could that be

var header = user + ':' + (pass === undefined ? '' : pass)

or if null is supposed to be a falsy value like it should

var header = user + ':' + (pass || '')

[simov]

Added a small comment, other than that if the RFC say so, it should be that way 👍

[erykwalder]

@simov Addressed your feedback

[nickmccurdy]

Should we keep this test and change ok to false, so we'll have a regression test for this change?

[erykwalder]

Removing these lines gives us the regression test, since the default is ok = false.

[nickmccurdy]

Ah, thanks for the explanation.

[nylen]

LGTM 😎