I'm logging the headers so that we get all the info about where the request came from (ip, forwarded-by, etc) bunyan has a nice parser for the full request, but then we end up with plaintext passwords in the logs, which is bad.