How do I edit past git commits to remove my password from the commit logs?

My problem: cygwin git doesn't seem to correctly prompt for credentials when using https:// URLs, so I used username and password in the URL. Unfortunately when I did a "get pull" it auto-commited a message with the full URL including password. I didn't notice this until after I had pushed the changes.

How do I edit old commit messages to eradicate the password in the URL?

My shared git repo is on my own server. I can do surgery on the repo if necessary.

Instructions on how to change my configuration (i.e. don't use Cygwin, don't use https) are unnecessary -- I'm trying to deal with what is already done.

Yes, I can and will burn the password but I'd still like to fix it.