sanitizePath

Rewrite the captured path, percent-encoded as sent, to hide a secret in it: a reset token, an API key in /v1/keys/<key>. Off by default, since most ids in a path (/orders/123) are what you want to see. Applies to the path and to the captured URL, in registration order; a transform that throws hides the whole path.