title: Username and password in https url
body: <p>Consider the URL:
  <a href="https://foo:password@example.com" rel="noreferrer">https://foo:password@example.com</a></p>
  
  <p>Does the username/password portion in the above example qualify as a "URL parameter", as defined in <a href="https://stackoverflow.com/questions/830074/can-a-username-and-password-be-sent-safely-over-https-via-url-parameters">this question</a>?</p>