obfuscate password length when sanitizing

If we are going to attempt to sanitize passwords out of logs, we may as well obfuscate the length of said password.