sanitize passwords in URLs when caching metadata

replace passwords with 'XXXX' when generating the file cache path to
store cache control headers for that URI.