#1256 Stripping auth token before sending request downstream