Remove password from log statement

[rdhaese]

When using http basic auth in the defaultZone, I'm seeing a INFO log statement that exposes the username and password.

I've added a function to replace the password in the url with 'PASSWORD' when logging.

While busy, I've applied some suggestions from intellij. Made some small edits for consistency.