The one change since the last patch was to use toString instead of toPrivateString when setting the remoteUri variable.

This seemed appropriate since the remoteUri is used in the commit message for the merge and the password shouldn't appear there if included in the URI.