Use of user:pass things?

Noticed that we seem to have some notion of using the user:pass things that are templated for URLs, see:

https://git.glasklar.is/system-transparency/core/stprov/-/blob/main/subcmd/remote/remote.go?ref_type=heads#L195-197

Then in other places we are hard-coding user:pass as "foo" "bar" with comment "out of scope", see:

https://git.glasklar.is/system-transparency/core/stprov/-/blob/main/subcmd/remote/run/run.go?ref_type=heads#L128-129

I wonder if this is going to blow up in someones face eventually.

CC @linus. Maybe related to #34 (closed).