credential: treat URL without scheme as invalid