Do not display username:password in URLs

The `id` isn't a tag so we should either `s/tag/id` or undo this change.