static S hideCredentials(S url) {
  ret url.replaceAll("&_pass=[^&]*", "&_pass=<hidden>");
}