Strip credentials from ambiguous source warnings.

Fixes #3249.
:+1: I won't be able to get back to this for about a week though...