Original comment by @pickypg:
Currently we allow the username to be set without the password in the HTTP Exporter. However, this results in a Basic Auth request like elastic:null (assuming elastic was the username), which is definitely not what the other side is going to expect for a blank password.
This was allowed in the first place because the Apache client accepts null, but since it literally passes null, that seems like a worthless thing to support.