closes #391

in practice, this ends up with annoying false positives

in particular, don't try to retroactively build call chain.
Fixes #385

fixes #372

and a password literal

should have been a test that the warning does _not_ appear.

because they are already in test/tests/ and
test/tests/test_* just seems silly to me

and combine with YAML checks

and friends