[Bountybette]

When the authority can't be parsed, uri.host, uri.port and uri.userinfo all return None, and Validator.validate treats None as "component absent", so Validator().allow_hosts("good.com").validate(uri_reference("https://user@user@evil.com/")) passes even though urllib.parse.urlsplit and requests send that URL to evil.com (the same gap skips allow_ports and forbid_use_of_password). validate now raises InvalidComponentsError for an unparseable authority whenever one of those checks is configured, so validators that only check the scheme or path behave exactly as before.