(previously tagged v2.2.8-pl is invalid)

Merge branch 'release-2.2'

* release-2.2:
  Prevent empty HTTP_MODAUTH from succeeding