obfuscate token in logs