This logic is duplicated in the proxy username validation. I think it belongs there. Transitively, if the password requires a user, and user requires a proxy URL, this check is redundant.