When the user/password arguments are set to undefined they should be treated as missing arguments. Either via an IDL option or because that is what undefined means per ES/IDL.
If we don't change Web IDL due to http://lists.w3.org/Archives/Public/public-script-coord/2012AprJun/0105.html then bang a [TreatUndefinedAs=Missing] on those two arguments. If we do change Web IDL, then [TreatUndefinedAs=Missing] will disappear and it'll just be the default behaviour.
I wonder what the behaviour should be if undefined is specified for username but not for password.
The other alternative here is that since undefined becomes null per IDL we could maybe make null mean missing in prose.
Currently user/password are a bit of a mess because of bug 10326 and to a lesser extent bug 15418. If someone could explain what we should do for them that would be nice.
Right. The big question is whether explicit null passed should mean "missing". If it should, then we should have a nullable string here with null as default value and just have the prose talk about null. If it should not, then we should use [TreatUndefinedAs=Missing], probably have this be a non-nullable string, and the prose should talk about missing arguments.
This is fixed as suggested in comment 3 by bug 17242 comment 16.