Strip credentials from ambiguous source warnings.

Fixes #3249.
Yeah, I think this will work. Another option is to just make it an instance variable... we'll have to calculate once per thread, but we can stop worrying about threads clobbering each other. Yet another option would be to write all the no-credential URLs before we spin up all the threads—reading is thread-safe, only writing is dangerous.