`:url` can log user email addresses:

```
info: GET /authenticate?email=alice%40gmail.com 200 3
info: GET /authenticate/forward?email=alice%40gmail.com 302 114
```

The GET on `/authenticate/verify` also contains the user's `openid.assoc_handle` and `openid.ext1.value.email`.

So... we should probably be purging query args from the URL.