First is username:password@url abuse. This notation - now deprecated because only an idiot would pass credentials in the HTTP query string these days Err... us

First is username:password@url abuse. This notation - now deprecated because only an idiot would pass credentials in the HTTP query string these days Err... username:password@host is not the query string and gets sent down the wire exactly like when you authenticate with the server the "normal" way.