Mask credentials in debug output

[thomluther]

This is to prevent that actual debug logs will reveal used tokens per default. Full debug can be re-enabled via class attribute