url transform passwords are scrubbed