From http://article.gmane.org/gmane.comp.web.wget.general/6861

HOW IT SHOULD WORK:

When "user:pass <at> " is specified, Wget should record that information, but
send nothing by default.

Once it receives a challenge, it should record the auth mechanism, realm
and protection-space information for the challenge, and feel free to
issue its response on all further URIs within the relevant protection
space (for the Basic mechanism, the protection space is the relevant URI
and all URIs deeper, and any URIs on the same host for which the server
issues a challenge with the same realm; for the Digest mechanism, the
protection space is either explicitly defined, or else consists of the
entire server).

In no event should the user:pass <at>  information be sent in the Referer
header; ideally, it should be parsed out at the very beginning, recorded
as just described, and then removed from the URI before it is used any
further.

--user and --pass can then become essentially equivalent to prefixing
every command-line-specified URI with "user:pass <at> " information: it will
wait until challenged, and limit future authenticated responses to the
appropriate protection spaces (and, in particular, not automatically use
them for each and every request, regardless of host).

While we're on the subject, authentication info should be readable from
a file, and certainly from the terminal with local echo turned off. At
some point, users should be able to describe protection-spaces and
associate user/pass info with them.