As is stated in the recent specification change :

http.url MUST NOT contain credentials passed via URL in form of https://username:[email protected]/. In such case the attribute's value should be https://www.example.com/