Fix #14036. Remove user/pass from ajaxLocation. Close gh-1340.

(cherry picked from commit eb1a2afc9fb1d990d10358aab0e17bc0ce1d1db3)

AUTHORS.txt

@@ -172,3 +172,4 @@ Terry Jones <terry@jon.es>
 Jeremy Dunck <jdunck@gmail.com>
 Chris Price <price.c@gmail.com>
 Amey Sakhadeo <me@ameyms.com>
+Noah Hamann <njhamann@gmail.com>

src/ajax.js

@@ -21,7 +21,7 @@ var
 	rlocalProtocol = /^(?:about|app|app-storage|.+-extension|file|res|widget):$/,
 	rnoContent = /^(?:GET|HEAD)$/,
 	rprotocol = /^\/\//,
-	rurl = /^([\w.+-]+:)(?:\/\/([^\/?#:]*)(?::(\d+)|)|)/,
+	rurl = /^([\w.+-]+:)(?:\/\/(?:[^\/?#]*@|)([^\/?#:]*)(?::(\d+)|)|)/,
 
 	/* Prefilters
 	 * 1) They are useful to introduce custom dataTypes (see ajax/jsonp.js for an example)