Let's remove the byteArray logging, it's unused (as toString doesn't log the byteArrays) and likely still audits passwords if you deserialize the array.