make sure the username / password is stripped from the URL

I was having the following issue with mechanize when using digest auth:

The first request to a website containing a form would succeed, but submitting the form then would fail with a 401:

```
Mechanize::UnauthorizedError: 401 => Net::HTTPUnauthorized for https://username:password@test.com/entry/? -- no credentials found, provide some with #add_auth -- available realms: App Zone
```

The thing to note is that the URI for subsequent requests contained the username/password as set by add_auth to mechanize. It uses this URI (the one including username/password) to lookup the credentials for the next request, and fail as no credentials are registered for that URI.

So I've made this patch to strip out the username / password from the URI before looking up the credentials.