I mean, for HTTP Basic there literally
is a single canonical string, and it's not uncommon to see people send you links like
https://user:somepasswordhere@example.com.
I think the arguments other commenters have made about logging, browser history storage, etc are more convincing