do not log auth header