By default don't hide user passwords from HTTP