fix(redis-cluster): correctly pass username and password

### Summary

Fixed a bug in redis-cluster connector where username and password
authentication did not work properly (the authentication without
username did work properly).

The username and password authentication requires Kong fork of the
redis-cluster library: https://github.com/Kong/resty-redis-cluster,
and does not work with the: https://github.com/steve0511/resty-redis-cluster.

Author: bungle

Changes.md

@@ -2,6 +2,11 @@
 
 All notable changes to `lua-resty-session` will be documented in this file.
 
+## [4.1.4] - 2025-08-11
+### Fixed
+- fix(redis-cluster): correctly pass username and password
+
+
 ## [4.1.3] - 2025-07-29
 ### Fixed
 - fix(utils): disable the SP800-132 compliance checks (on FIPS mode, but doesn't violate FIPS)

lib/resty/session/redis/cluster.lua

@@ -207,12 +207,12 @@ function storage.new(configuration)
   local ssl_verify              = configuration and configuration.ssl_verify
   local server_name             = configuration and configuration.server_name
 
+
   local auth
-  if password then
-    if username then
-      auth = username .. " " .. password
-    else
+  if not username then
+    if password then
       auth = password
+      password = nil
     end
   end
 
@@ -234,6 +234,8 @@ function storage.new(configuration)
         max_connection_attempts = max_connection_attempts,
         max_connection_timeout = max_connection_timeout,
         auth = auth,
+        username = username,
+        password = password,
         connect_opts = {
           ssl = ssl,
           ssl_verify = ssl_verify,
@@ -263,6 +265,8 @@ function storage.new(configuration)
       max_connection_attempts = max_connection_attempts,
       max_connection_timeout = max_connection_timeout,
       auth = auth,
+      username = username,
+      password = password,
     },
   }, metatable)
 end