Canonicalize CURL-based URLs to include the username but no password
Warn if a protocol is vending out passwords