Also no encoded basic auth or raw ip addresses (not that a useful website would likely _use_ raw ipv4 or 6 since that causes huge CORS and sometimes even DNS issues...)