push --user U --password P with no URL parsed to a payload-less no_url, which the verb rebuilt as a bare empty URL, dropping the credential; the push went out anonymous and a peer requiring a login refused it. The parser now mirrors sync: an omitted URL is an empty one, resolved to the saved remote at run time, and the credential comes through. S12 asserts an authenticated no-URL push and a stored-login push both land on fossil. check-in: 4dba18d355 user: dmestas tags: trunk