Seems a bit odd that the username and password are still in the URL? Don't think it'll directly harm anyone but maybe worth a comment and a little extra thought?