Backslash escaping is required for colon before password in string syntax

[jeremyroman]

i.e., you must write https://alice\:bob@example.com/; failing to escape the colon leads to the username pattern being parsed as alice:bob. We should either change or document this.