make _split_url returns user/password info
add Basic auth support from URL
revise auth tests to confirm no leak on redirect
document Basic auth support