Allow requests with cookies to be hashed, don't hash Authorization headers
Merge remote-tracking branch 'upstream/master'