Fix #14036. Remove user/pass from ajaxLocation. Close gh-1340.
(cherry picked from commit eb1a2afc9fb1d990d10358aab0e17bc0ce1d1db3)