WebKit should prevent push/replace state with username in URL.