Filter out HTTP_AUTHORIZATION header contents

Yeah, e-mailing everyone the base64-encoded credentials for every HTTP basic
auth'd request that generates an error... not cool.  Not cool at *all*.