soup_uri_to_string: document that passwords are never output