Make sure the user and password for the second request is taken from the redirected-to URL. Add test case 899 to verify. Reported-by: James Lucas Fixes #11410 Closes #11412