Only require one of date or request-id tokens, not both

Hostname is too long with both if the request ID is a UUID