Based on your requirements this is impossible. Any link on a page that is sent to the user will have the user name and password within it. You can obfuscate the link with JavaScript but as soon as the link is clickable they can use 'Copy Shortcut' to get the entire link including the username password.
BTW: FTP is a very old insecure protocol that has this flaw. Anyone can install Fiddler or Wireshark and watch for the FTP request that has the username password. FTP doesn't support SSL so you can't block it.