Strip credentials from ambiguous source warnings.

Fixes #3249.