Http auth is a mess of a system that has been a net negative for security by making people screw up hostname parsing because they didn't expect the auth syntax.