Avoids sending around user passwords in exception mails.

Exception notifier would've picked this up. There are other request
parts (like raw_post_data) containing the password but these seem to be
stripped by exception_notifier itself.

[api] do not allow to "addreview" or "changereviewstate" in a request, which is not in "review" anymore