Strip out credentials when adding URIs to x-received-from header.
Rewrite to use uri_parser:parse/2 and add unit tests.
Also test that we don't unescape wrongly.
Oops
Merged bug25483 into stable