Use RFC-compliant URL parsing to redact auth credentials