If you put the wrong user name in a link you can still log in even though the user doesnt exist.
I tried
http://fred@localhost and I successfully logged in. :O
I dont think its such a big deal because It only worked because the root of my file system doesnt have restricted access for users set.