MergeXHRSettings doesn't merge username and password

[AllinolCP]

Version

• Phaser Version: Phaser 4.0.0 RC6

• Operating system: Windows 11

• Browser: any

Description

When using loader.user and loader.password globally, the value gets ignored by Loader because MergeXHRSettings prefers the file's config (which doesn't have user or password) which in turns removes the username and password.

Example Test Code

https://phaser.io/sandbox/7HVaFUcR
test code is here, the request to https://cdn.phaser.io/sandbox/square-earth.png doesn't have a Authorization header when it should have one.

Additional Information