Password is put in URL instead of header or basic auth

[hkrutzer]

Pillar puts the Clickhouse password in the URL when connecting. This means it can end up in log files and is more easily leaked.

https://clickhouse.com/docs/en/interfaces/http/#default-database says:

The username and password can be indicated in one of three ways: [..] 2. In the ‘user’ and ‘password’ URL parameters (We do not recommend using this method as the parameter might be logged by web proxy and cached in the browser).

The documentation recommends using either a HTTP header, or HTTP basic auth.