ToJSON for URI includes passwords

[ezrakilty]

The instance of ToJSON given for Network.URI objects passes id for the function that is intended to sanitize passwords out of the UserInfo field of a URI, meaning that by default uses of this instance will include any password in the output:

aeson/src/Data/Aeson/Types/ToJSON.hs

Line 2154 in c93d60d

toJSON uri = toJSON (URI.uriToString id uri "")

There will be many cases where users probably do want to serialize the password component of a URI, but it is perhaps not a good default. What do you think?