Figure out whether embedded credentials are supposed to be allowed in URLs

[taymonbeal]

Currently, we allow embedded credentials in URLs, because I haven't put in a check to explicitly disallow them. There's a comment to the effect that they're not supposed to be allowed in the Chrome codebase, and I could swear at one point I saw the code that actually implemented this check, but I can't find it now.

I think this might be security-relevant but am not super clear on the details. I wish there was an actual spec...