Change password prompt to use stderr

[samiam]

Feature Request

When prompting users to enter passwords, I propose using stderr instead of stdout to avoid co-mingling the password prompt and the response (token). This helps when output is being captured into a variable.

Example of current behavior (v0.8.2):

$ VAULT_TOKEN=$(/usr/local/bin/vault auth -method=ldap -token-only username=$USER)
$ echo $VAULT_TOKEN
Password (will be hidden): ed0bcd25-XXXXXX

Example of patched behavior (v0.9.1):

$ VAULT_TOKEN=$(vault auth -method=ldap -token-only username=$USER)
WARNING! The "vault auth ARG" command is deprecated and is now a subcommand
for interacting with auth methods. To authenticate locally to Vault, use
"vault login" instead. This backwards compatability will be removed in the
next major release of Vault.

Password (will be hidden):
The token was not stored in token helper. Set the VAULT_TOKEN environment
variable or pass the token below with each request to Vault.

$ echo $VAULT_TOKEN
d8cdb404-XXXXXXX

FYI, in the last case, using vault login is still the same behavior.

Justification

The reason for this request is to ensure the output returned is clean without superfluous data.

There's no standard on this behavior - it's just the UNIX way! 😄

If you are looking for precedent, Bash's builtin read() command also prompts on stderr.
https://tiswww.case.edu/php/chet/bash/bashref.html#Bash-Builtins

$ read -s -p "Stderr prompt: " VAR
Stderr prompt: <secret_typed>
$ echo $VAR
secret

$ read -s -p "Stderr prompt: " VAR 2> /dev/null
<secret_typed>
$ echo $VAR
secret

Patch

My patch is a naive attempt to change the prompt to write to stderr instead of stdout for all the command line (cli) utilities.

There are two implementation changes:

1. The prompt for the password is written to stderr

2. The newline printed after the password is entered is also written to stderr.

Notes

Both 'github' and 'token' methods setup a write stream variable. Presumably that can be overwritten for testing purposes, but I'm not sure.

Furthermore, it seems odd that the other cli's (ldap, okta and userpass) write directly to stdout/err and do not make use of a stream variable. Seems like all the cli's should be consistent - either use a stream/write variable or not.

Comments welcome.

-Sam