Curl has two ways of enabling HTTP basic user authentication:

 A) curl -u user:password http://host.com

or

 B) curl http://user:password@host.com

Now, imagine that the site sends a redirect to another absolute URL (without
user+password in the URL of course) and we tell curl to follow that Location:
header.

What should curl do with the authentication data in the second request?

How does curl do today?

 o 7.6.1 => crashes

 o 7.7-beta => behaves differently, depending on that method you're using:
   A) passes the authentication on both requests
   B) extracts the info on a per-request basis, so the first request uses the
      authentication and the second page will be fetched without it.

Of course, nothing of this is actually documented anywhere! B-]

-- 
  Daniel Stenberg -- curl project maintainer -- http://curl.haxx.se/