Posted trivial patch to correct this behaviour. All it does is stripping the user:pass@ or user@ part out of the repository URL before matching against the URL in the API request. Therefore posting to notifyCommit with an https://server/repo/address should trigger a poll on a mercurial repo with an https://user:pass@server/repo/address as well.
Another possibly good change is swapping the line that says:
if (url.equals(repository)) urlFound = true; else continue;
if (repository.startswith(url)) urlFound = true; else continue;
This would allow for a single API call to http://jenkins/mercurial/notifyCommit?url=http://server/ to trigger a poll on all repos on that server, or to specific repository groups located at http://server/group1/etc. Good on tools like Rhodecode that only allow you to define system-wide hooks, not repo-specific ones.
I tested the regex in the patch above and it does what it's supposed to, but I don't have a build system to actually test this out.