Sensitive information exposure via logs.

[amcgregor]

Howdy! One of the little details I've run into is that there are logging statements within the codebase that log sensitive information, e.g. connection URI (without password redaction) or straight-up logging of the credentials, e.g. https://github.com/bwmcadams/mongodb_beaker/blob/master/mongodb_beaker/__init__.py#L256 :

log.info("Attempting to authenticate %s/%s " % (username, password))

Please avoid logging passwords! Thank you.

[amcgregor]

Additionally, all of the URI parsing and processing included within this project can be essentially eliminated through utilization of the uri library. To correct this, and to correct the seeming inability to specify self-expiry dates (valid_until for use with TTL indexes) on sessions, we have vendored this library into our application and patched.

More than two years to correct a security issue.