[nightpool]

I mean, for HTTP Basic there literally is a single canonical string, and it's not uncommon to see people send you links like https://user:[e-mail].

I think the arguments other commenters have made about logging, browser history storage, etc are more convincing