hide http auth infomation in log