enabling debug for return from auth() but masking out the real token