This needs a test, it can be fairly straightforward I think, just test the return code in the fail case. See test2044 for a very simple example. (edit: on second thought you'll probably need to start the HTTP server in the test so that you have a valid URL to pass)

CI says add to symbols-in-versions and document in cmdline-opts, and tool_help.c. I would rename the tool switch from --disallow-username to --disallow-username-in-url. It's longer but for someone reading a script it's easier to understand what it does.

I suggest not using TODO: as the area because it reads like you're adding something to the todo. sample alternatives
lib: Add option to disallow usernames in URLs
url: Add option CURLOPT_DISALLOW_USERNAME_IN_URL
etc

It seems the new test case 2074 fails sometimes? Is it because of different build options?

@zagor Any chance you're up for rebasing this and fixing the conflict?

Absolutely!

Thanks! (slightly edited before I pushed)