A URL with credentials (http://user:pw@host/) leaves them on document.baseURI even though location is cleaned, and fetch() refuses any URL carrying credentials — so every enhancement failed at once: diff toggle, unread poll, diff sentinel. A server-stated <base> fixes all of them without script, since the server knows the URL from its own routing and never from userinfo.

The toggle also swallowed its own fallback: replaceState to a credential-free URL throws on such a page, and it ran before @get while __prevent had already cancelled the link — neither swap nor navigation. Cosmetics now cannot fail the click. check-in: c35d8c4b5b user: dmestas tags: trunk