Well, basic auth is plaintext over the wire anyway. I don't think that you lose that much 'security' by putting them into the url.

That said, the most common argument that I heard against supporting this stuff is phishing, using the credentials part to push the real address as far as possible to the right/off the screen.

I - don't like that decision. I have basic auth services in internal networks and would like to access them this way.