obscure authorization header value when logging