URL as a parameter in path broke `cleanHostValue`

The fix consists mostly in strenthening the URL pattern.

As an addition, a warning is raised when a password is detected in the given URL.
Because there are better way to do it (especially on plain HTTP scheme).

closes #48