Before turning them into an authentication header, the user or password
supplied in hosts must be URL decoded.
The RFC https://tools.ietf.org/html/rfc3986 describes userinfo like:
userinfo = *( unreserved / pct-encoded / sub-delims / ":" )
and python documentation about urlparse says:
The components are not broken up in smaller parts (for example, the
network location is a single string), and % escapes are not expanded.
It is the caller job to unquote them before using them.
For instance, a character like "]" cannot be supplied in a host or
urllib will incorrectly interpret it using ipv6 syntax.
Fix#568
Patrick Mézard