UX: help users realize that configuring SYSAND_CRED_X=https://domain/ isn't sufficient (`**` needed)

[consideRatio]

Its the second time I mistakenly configure just something like SYSAND_CREX_X=https://domain/, but in practice needing to do SYSAND_CREX_X=https://domain/**.

I figure we can help users realize that this likely is a misconfiguration

[tilowiklundSensmetry]

The reason for the current design is ease of implementation (mapping straight to the underlying glob matcher) and security (to not accidentally send credentials).