URL Filtering can also filter for usernames and passwords in the traffic sent from users to websites. This requires a read only domain server and a user-ID agent on the sever collects the usernames and associated hashes for the user password. URL filtering is considered part of Content-ID.
With PA 9.X there is a specific URL section within the service location that allows you to select a specific URL policy and block that traffic.
JD's Notepad 