Strip credentials from ambiguous source warnings.

Fixes #3249.
probably we want to create a credential-less map of source urls and use that so that we don't have to dup and remove creds from the same source urls hundreds of times?