Introduce `safeUrl` which scrubs passwords from query parameters