url: add some defensive asserts on expected incoming types
Our type handling is a nightmare here, and we're loading passwords to
do network IO, so we can afford to be potentially-slow but pedantic
here.
Differential Revision: https://phab.mercurial-scm.org/D5734