Turns out I just didn't read the documentation well enough!
I write a short "How to" if someone else is stupid enough to miss it like I did! :)
To enable username and password authentication simply uncomment %{username, []} (remove the %) in emqttd.config.
Then use emqttd_ctl to add or remove users as described in the documentation (
https://github.com/emqtt/emqttd/wiki/Authentication):
load user with './bin/emqttd_ctl'
Load user with './bin/emqttd_ctl users' command.
./bin/emqttd_ctl users add <Username> <Password>
Thanks for a great broker!