username/password may also be set in URL
as this was the sole option for pre-1.4 to pass such credentials