scrub access token from logs