[wip] redact username/password when logging

As pointed out by @ace20022 we're logging too much information - including credentials. There are for sure a lot more spots where we actually push out the entire path. In case you find some more, please add or let me know.

Another approach would be to redact by default when logging. I've not yet looked into that code yet, so not sure how easy that would be. What do you guys think?