OpenID Identity "user@domain" results in unecessary HTTP Authentication Basic Header

We used two Drupal installations (Provider and Consumer) to track and analyse a OpenID Login process.

While doing this, we've seen that the Consumer sent a HTTP Authentication Basic Header to the OpenID Provider. This is because the OpenID Identity "user@domain" was passed to http://api.drupal.org/api/function/drupal_http_request/7, and parse_url() then thinks that "user" is a HTTP Authentication username.

This is does not break functionality nor is it a security issue, because no confidental information is published (the OpenID Identity is public), however, the spec says that the Consumer should normalize a OpenID Identity. Also, it is unlikely, but a Provider could for some reason block HTTP requests with Basic Authentication headers and this would break the discovery process.

I'll try to write a patch soon.