If the request contains credentials in its url, they should be stripped from it. Also first attempt shouldn't contain basic auth header.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

PASS () => xhr.responseText is 'User:  Password: '
PASS () => xhr.responseText is 'User: foo Password: bar'
PASS () => xhr.responseText is 'User:  Password: '
PASS () => xhr.responseText is 'User: foo Password: bar'
PASS successfullyParsed is true

TEST COMPLETE