Scrub session as well. Add :secret_token to default scrub list. Fix bug with fparam filtering when params is nil.