> > How are you suggesting these should work?
> 
> The simplest approach is merely to recognize URLs in the form 
> https://user:pass@host/
> 

That is secure for what? Classroom examples?

> This could be implemented in a current processor without any spec changes.
> 
> The alternative would be a new document function (initially in an 
> extension namespace until XSLT 2.1) with two extra arguments. E.g.
> 
> document($uri-sequence as item()*, $base-node as node()) as node()*, 
> $username as string, $password as string)
> 
> Details are probably a little off, but that's the idea.