third_party/web_platform_tests/XMLHttpRequest/open-user-password-non-same-origin.htm

<!DOCTYPE html>
<html>
  <head>
    <title>XMLHttpRequest: open() - user/pass argument and non same-origin URL doesn't throw</title>
    <script src="/resources/testharness.js"></script>
    <script src="/resources/testharnessreport.js"></script>
    <link rel="help" href="https://xhr.spec.whatwg.org/#the-open()-method" data-tested-assertations="following::ol/li[9]/ol/li[1] following::ol/li[9]/ol/li[2] following::ol/li[15]/ol/li[1]" />
  </head>
  <body>
    <div id="log"></div>
    <script>
      var m = "GET",
          u = "http://test2.w3.org/",
          a = false
        test(function() {
          var client = new XMLHttpRequest()
          client.open(m, u, a, "x")
          assert_equals(client.readyState, 1, "open() was successful - 1")
          var client2 = new XMLHttpRequest()
          client2.open(m, u, a, "x", "x")
          assert_equals(client2.readyState, 1, "open() was successful - 2")
        })
    </script>
  </body>
</html>