AUTH: avoid logging creds on ACL denial