luci-base: remove security token from urls