Clear username and password from location.href when basic HTTP

Source/core/frame/Location.cpp

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 50 matching lines @@
         return blankURL(); // Use "about:blank" while the page is still loading (before we have a frame).
 
     return url;
 }
 
 String Location::href() const
 {
     if (!m_frame)
         return String();
 
-    return url().string();
+    return url().strippedForUseAsHref();
 }
 
 String Location::protocol() const
 {
     if (!m_frame)
         return String();
     return DOMURLUtilsReadOnly::protocol(url());
 }
 
 String Location::host() const
@@ skipping 187 matching lines @@
         argv.append("LocalDOMWindow");
         argv.append("url");
         argv.append(enteredDocument->url());
         argv.append(completedURL);
         activityLogger->logEvent("blinkSetAttribute", argv.size(), argv.data());
     }
     m_frame->navigate(*callingWindow->document(), completedURL, locationPolicy == SetLocation::ReplaceThisFrame);
 }
 
 } // namespace blink