redactUrl

Redact sensitive parameter values in url — in the query string and in the fragment alike. An OAuth implicit-flow redirect carries its token only in #access_token=…, often with no query string at all. A fragment that isn't a name=value list (#section, #/route) has nothing to match and passes through. Pure string transform — no URL parsing dependency — so malformed URLs pass through untouched.