Wget can reuse Basic auth across redirects to a different host

A redirected HTTP request can carry credentials to an attacker-controlled origin when Wget auto-reuses Basic auth state across requests. The code registers a host as Basic-authenticated and later sends credentials based on host membership, but redirect handling does not appear to enforce that the redirected target matches the original origin before applying the cached credentials.