hide http auth infomation in log

EDIT: updated to avoid issue where the auth appears multiple times in
the url.  For example: `http://http@http.com` would turn into
`***://http@http.com` -- @isaacs
v0.2.24