Identify masked variable output clearly

Masked variables being replaced with `[MASKED]` or with `xxxxxxx`
depending on where the masking is happening is confusing (and currently
neither(!) are explained in the docs).

A masked variable has to be 8 characters or longer, which is exactly the
length of `[MASKED]`. We can replace the first eight `x` in each masked
variable on the Rails side with `[MASKED]` and have a slightly more
consistent outcome for users.