Password not required

Some APIs (including mine!) use HTTP Basic Auth, but read the username as an API token and ignore the password field. Notably, [Stripe](https://stripe.com/docs/api/ruby#authentication) does this. It would be great to have the ability to pass a `passwordRequired` option, which defaults to true to preserve backwards compatability, but that can be set to false to disable the requirement.

From this:

```
var userid = credentials[0];
var password = credentials[1];
if (!userid || !password) {
return this.fail(this._challenge());
}
```

To this:

```
var userid = credentials[0];
var password = credentials[1];
if (!userid || (options.passwordRequired && !password)) {
return this.fail(this._challenge());
}
```

I'm happy to submit a pull request

Start by locating the HTTP Basic authentication strategy code containing the credential validation shown in the issue, then inspect how strategy options are defined and passed. Add the passwordRequired option with its default behavior and verify that username-only credentials succeed when it is false while missing passwords still fail by default.

Written by the indexing model from the issue text.