Sprinkle sensitive_variables and sensitive_post_parameters everywhere

We should be filtering sensitive data out of logs of views that contain them. Particularly passwords/reset tokens etc.