assertion failed: self.byte_at(self.host_start - 1) == b'@' in Url::password

Found by fuzzing more code in this crate.

let url = Url::parse("a://:1").unwrap();
url.password(); // thread 'main' panicked ...

thread 'main' panicked at 'assertion failed: self.byte_at(self.host_start - 1) == b'@'', src/lib.rs:739:12
stack backtrace:
   0: std::sys::imp::backtrace::tracing::imp::unwind_backtrace
             at /checkout/src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:49
   1: std::sys_common::backtrace::_print
             at /checkout/src/libstd/sys_common/backtrace.rs:71
   2: std::panicking::default_hook::{{closure}}
             at /checkout/src/libstd/sys_common/backtrace.rs:60
             at /checkout/src/libstd/panicking.rs:381
   3: std::panicking::default_hook
             at /checkout/src/libstd/panicking.rs:397
   4: std::panicking::rust_panic_with_hook
             at /checkout/src/libstd/panicking.rs:577
   5: std::panicking::begin_panic
             at /checkout/src/libstd/panicking.rs:538
   6: url::Url::password
             at src/lib.rs:739
   7: testurl::test
             at ./testurl.rs:15
   8: testurl::main
             at ./testurl.rs:38
   9: __rust_maybe_catch_panic
             at /checkout/src/libpanic_unwind/lib.rs:99
  10: std::rt::lang_start
             at /checkout/src/libstd/panicking.rs:459
             at /checkout/src/libstd/panic.rs:361
             at /checkout/src/libstd/rt.rs:59
  11: main
  12: __libc_start_main
  13: _start

Reproduce the panic from the issue using the Url::parse("a://:1") and url.password() example, then inspect src/lib.rs around line 739. Use testurl.rs as the existing reproduction entry point; done means this input no longer panics when querying the password.