pull Open into NewRequest

this also removes support for user and password -- at least two
browsers (IE and modern Chrome) don't support it anymore