Comment 8 for bug 1571714

The patch Ben proposed seems good in principle (some of the formatting seems to have been lost so I would want to review it via gerrit or a patch file or something if we need a stronger vote of confidence to go ahead with it).

The strutuils code to mask secret values should be relatively easy to extend if we need to, and it has a long list of regexes now IIRC. If someone does want to log passwords, they can do so by avoiding those patterns, so I think securing this by default is a good idea.