Use RFC-compliant URL parsing to redact auth credentials

(cherry picked from commit 1e2d670d33a2fb8c0df1a9d617d037a8d1f1848b)