Strip credentials from ambiguous source warnings.

Fixes #3249.
Good point. I'll update.