Set BasicAuth in http.go only if username and password are not empty (#914)

[github-actions[bot]]

This prevents error "read/write on closed pipe".

Go's http.client::send() always closes req.Body, so if the first request attempt is unsuccessful, any subsequent requests after calling the CredentialsCallback will attempt to read/write on a closed pipe.

(cherry picked from commit 9db5de109c166aa802b85cfae2dced3c4728a00d)