url: allocate username, password, and options on the heap

This makes it possible to increase the size of the buffers when needed
in later patches.  No functional change yet.