The userinfo check read the authority after `//`, so `https:\\alice:pw@host`,
`https:alice:pw@host` and `https:/\alice:pw@host` passed. object.url now refuses any
`?`, `#`, `@` or `\`, a path `@` included, so no query, fragment or user information
enters an observation however a parser splits the URL. Corpus cases for the three
bypasses, a backslash alone and a path `@`; the escaped-URL observation keeps a quote
(its backslash moved out with the rule). Section 8.2 also states that no syntax keeps
an address, a token or personal data out of `cid`: an emitter MUST NOT put one there,
and the charset stays a syntax rule.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
c0fb53548c