This is something Python should deal with, so the issue should remain open.  Whether it is a feature or a bug is still open to at least a little bit of debate.

This is particularly the case in this instance because the reason these sites are breaking the spec is out of security concerns.  Traditionally Python's backward compatibility/feature strictness is slightly more relaxed in the face of security issues.  So, if there is a non-trivial and growing number of web sites we can't talk with because of their security stance, there is at least an argument that this can be changed in maintenance releases.

Another argument in this vein is that the change does not mean that a *program* written in python x.y.z will fail if run under python x.y.z-1, but only that it will fail to talk to certain web sites in x.y.z-1.  That feels much more like a bug fix than a feature.  (Of course, if it is a program designed to talk to one of those websites exclusively, then that calculus would change, but we're looking at it from the perspective of a general class of python programs, not a particular program.)

This assumes that the fix is in the vein of the optimization of automatically sending the auth for all sub-urls, as suggested by the RFC.  If it requires changing the API, then it is no question a feature.