One instance is in executeTask, using wget (line 332), the split for @ in the URL isn't correct when the username also has an @. The other download methods appear to not even support authentication (something to keep in mind for Windows instance which don't have wget).

You see this in a chained conversion, e.g. PEcAn, when the file is posted and Polyglot hosts it and requires authentication.