static S hideCredentials(URL url) { ret url == null ? null : hideCredentials(str(url)); }

static S hideCredentials(S url) {
  ret url.replaceAll("([&?])_pass=[^&\\s]*", "$1_pass=<hidden>");
}