1. allow clients to turn on/off request/response logging
2. hide password