Function redact_for_log 

pub fn redact_for_log(url: &Url) -> String

Return a loggable form of an origin URL with userinfo (user:pass@) stripped. Operators may legitimately use basic-auth-in-URL for internal origins, but those credentials must not reach logs or error messages.

Fails closed: if the setters can’t strip userinfo (cannot-be-a-base URLs, or URL-parsing ambiguity that misattributes credentials into host/path), we emit a fixed placeholder rather than echoing anything that might contain secrets. Callers from parse_origin_url and the HTTP origin’s fetch path always pass http/https URLs (parse-and-scheme validated, with .join() preserving scheme), so the happy path is expected here.