index.js: Add credentials warning on 401s

Closes #1.
deps: Replace `sprintf` with `util.format`
index.js: Don't display auth header with DEBUG=*

Closes #2.