Don't expose X-Auth-Token in heat CLI

Heat CLI exposes X-Auth-Token in debug mode. This patch replaces
X-Auth-Token's value with '{SHA1}<sha1oftoken>'. Some credentials
are exposed by keystoneclient as heatclient uses keystoneclient to
authenticate, it will be fixed in bug:100414.

Change-Id: Ic768af5a947535807ba449fb0aeb1eb98dac56e6
Partial-Bug: #1327019
Update stack-preview usage text

`--timeout` during stack-preview is only used in certain validation
paths and `--enable-rollback` is not used at all except to be consistent
with stack-create.  This changes the usage text to reflect these
peculiarities.

Change-Id: I9eafad207075f70b1321bb3559cb1363fe526f85
Remove unused/mutable default args

Having mutable default args is a bad idea
(http://docs.python-guide.org/en/latest/writing/gotchas/#mutable-default-arguments).

Change-Id: Id941f259ff362f306582be5c2e4bdea133149491
Merge "Update stack-preview usage text"
Merge "Remove unused/mutable default args"
Merge "Don't expose X-Auth-Token in heat CLI"