make sure the username / password is stripped from the URL when doing lookups for credentials