Wrap password logging in logs behind $c->dbg['password'] = 1;