Scheme: "http",
				Host:   "host.tld",
				Path:   "this:that",
				User:   UserPassword("user", "password"),
			},
			want: "http://user:xxxxx@host.tld/this:that",
		},
		{
			name: "blank Password",
			url: &URL{
				Scheme: "http",
				Host:   "host.tld",
				Path:   "this:that",
				User:   User("user"),
			},
			want: "http://user@host.tld/this:that",
		},
		{
			name: "nil User",

	return fn(req)
}

// Issue 16036: send a Request with a nil Body when possible
func TestReverseProxy_NilBody(t *testing.T) {
	backendURL, _ := url.Parse("http://fake.tld/")
	proxyHandler := NewSingleHostReverseProxy(backendURL)
	proxyHandler.ErrorLog = log.New(io.Discard, "", 0) // quiet for tests
	proxyHandler.Transport = RoundTripperFunc(func(req *http.Request) (*http.Response, error) {

// when not empty.
//
// tls.Config.ServerName (non-empty, set to "example.com") takes
// precedence over "some-other-host.tld" which previously incorrectly
// took precedence. We don't actually connect to (or even resolve)
// "some-other-host.tld", though, because of the Transport.Dial hook.
//
// The httptest.Server has a cert with "example.com" as its name.

		{
			name: "wildcard and explicit unknown",
			cfg: []Configer{
				vsArgs{
					Namespace: "default",
					Match:     "*.tld",
					Dest:      "wild.example.com",
					Time:      TimeOlder,
				},
				vsArgs{
					Namespace: "default",
					Match:     "example.tld",
					Dest:      "explicit.example.com",
					Time:      TimeNewer,
				},
			},
			proxy:     proxy("default"),