I have a similar issue with auth_password being blank after upgrading to CF10. Works fine when I incorporate auth_user/auth_password and CFHTTP in CF9.
using windows 2008r2/iis7x with basic authentication over ssl
I found a tech note that helped: It said to enable anonymous authentication AND windows authentication at the root level on IIS and then disable anonymous authenticaion at the directory where I am using auth_user in my application.