Removing web credentials from debug log (runatlantis#2072)

* Hashing web credentials

* Fix syntactic error

* Using strong cryptogrpahic primitive

* Entirely removing credentials

* Removing unused constant

* Removing redundant formatting parameters

server/middleware.go

@@ -52,13 +52,12 @@ func (l *RequestLogger) ServeHTTP(rw http.ResponseWriter, r *http.Request, next
 		user, pass, ok := r.BasicAuth()
 		if ok {
 			r.SetBasicAuth(user, pass)
-			l.logger.Debug("user: %s / pass: %s >> url: %s", user, pass, r.URL.RequestURI())
 			if user == l.WebUsername && pass == l.WebPassword {
-				l.logger.Debug("[VALID] user: %s / pass: %s >> url: %s", user, pass, r.URL.RequestURI())
+				l.logger.Debug("[VALID] log in: >> url: %s", r.URL.RequestURI())
 				allowed = true
 			} else {
 				allowed = false
-				l.logger.Info("[INVALID] user: %s / pass: %s >> url: %s", user, pass, r.URL.RequestURI())
+				l.logger.Info("[INVALID] log in attempt: >> url: %s", r.URL.RequestURI())
 			}
 		}
 	}