Don't log queries as they come in; parse them first to see
what they're about. If they contain passwords, obfuscate
them. Then log (before query execution), so that general,
binary, and slow query log will not contain clear-text passwords.
--log-raw option disables this for general log (un-rewritten
queries will be logged, before parsing rather than after). Can
be extended to do any other rewriting.