Reject URIs containing user information

WebSocket URIs do not contain user information per section 3 of RFC
6455.

Fixes gorilla#65

client.go

@@ -130,6 +130,11 @@ func parseURL(s string) (*url.URL, error) {
 		u.Opaque = s[i:]
 	}
 
+	if strings.Contains(u.Host, "@") {
+		// WebSocket URIs do not contain user information.
+		return nil, errMalformedURL
+	}
+
 	return &u, nil
 }
 

client_test.go

@@ -20,6 +20,7 @@ var parseURLTests = []struct {
 	{"wss://example.com/", &url.URL{Scheme: "wss", Host: "example.com", Opaque: "/"}},
 	{"wss://example.com/a/b", &url.URL{Scheme: "wss", Host: "example.com", Opaque: "/a/b"}},
 	{"ss://example.com/a/b", nil},
+	{"ws://webmaster@example.com/", nil},
 }
 
 func TestParseURL(t *testing.T) {