clean_rack_request_data should also filter out "action_dispatch.secret_token" to prevent passing a Rails applications secret token