Allow requests with cookies to be hashed, don't hash Authorization headers