Never emit URL-embedded passwords in log/status messages.

This resolves #20 by adding `scrub_auth_from_string`, which uses a regex
to find URLs with embedded passwords and obscure the password portion.
The change affects both log gile output and installation status messages
(which are shown in dashboard's web interface, right above the progress
indicator).
Use `is_running` where appropriate, formatting cleanups.

To check whether or not a process is running, use the `is_running`
accessor method, rather than test `running_processes` directly. This
shouldn't change any behavior.