Throw on authentication in url string

Closes #106

index.js

@@ -182,9 +182,17 @@ function normalizeArguments(url, opts) {
 		throw new Error('Parameter `url` must be a string or object, not ' + typeof url);
 	}
 
+	if (typeof url === 'string') {
+		url = urlLib.parse(prependHttp(url));
+
+		if (url.auth) {
+			throw new Error('Basic authentication must be done with auth option');
+		}
+	}
+
 	opts = objectAssign(
 		{protocol: 'http:', path: ''},
-		typeof url === 'string' ? urlLib.parse(prependHttp(url)) : url,
+		url,
 		opts
 	);
 

test/arguments.js

@@ -52,6 +52,13 @@ test('arguments - overrides querystring from opts', t => {
 	});
 });
 
+test('arguments - should throw with auth in url', t => {
+	t.throws(() => {
+		got(`https://test:45d3ps453@account.myservice.com/api/token`, () => {});
+	}, /Basic authentication must be done with auth option/);
+	t.end();
+});
+
 test.after('arguments - cleanup', t => {
 	s.close();
 	t.end();