Strip credentials from ambiguous source warnings.

Fixes #3249.
It would have to be an instance variable of an object that is owned by a single thread (which this source object isn't). Precomputing might work, but could also be tricky... the simplest thing would be if URI could return its own anonymized self and cache it per-instance, but I'm guessing we don't want to monkey patch URI! :-)