remove passwords in URLs from all log messages