#37: conform username:password with w3c spec