There is one non-intuitive thing with securing Mercurial. You should remove all authentication data from URL and TortoiseHg will actively enforce it (assuming that you are Yes guy). However even with mercurial_keyring extension enabled it will ask for a user name and password. And it will ask every time you push.
Don't worry. It isn't that mercurial_keyring extension is broken, we are just missing some data in %USERPROFILE%\mercurial.ini
configuration file:
[extensions]
mercurial_keyring =
[auth]
bb.schemes = http https
bb.prefix = bitbucket.org
bb.username = jmedved
Example above is something I use for BitBucket but it is applicable for any other server. Only thing that needs to change is prefix (bb in this case) that needs to be unique within configuration file and prefix of your server.