[wip] Trace requests

Does this have implications for the yubikey/messagebird api calls? Don't think it should (seeing it is a `X-` header), but still...