Strip credentials from ambiguous source warnings.

Fixes #3249.
Come to think of it, this probably isn't thread-safe either :frowning: