5.1.2 just specifies that it's a RequestURI and does not further define it.
3.2 refers you to RFC 2396, the URI spec, which includes mailto.
It's a valid URI and you are allowed to ask for it.
I'm not sure if I understand. The one I'm looking at further defines it as:
Request-URI = "*" | absoluteURI | abs_path | authority
Still, doesn't include user:password@domain, though :-P
Src: http://www.ietf.org/rfc/rfc2616.txt