credential: treat URL with empty scheme as invalid