Hide HTTP authentication credentials in error messages

This information is still accessible from `error.request.url`
if it is needed for debugging.