Requests containing sensitive information are sometimes logged, either because exceptions are thrown or due to normal debug logging. We should provide a "sensitive" configuration option that prevents request headers, body, and response body from being logged.
Optionally, we can provide a mechanism to more specifically prevent the logging of particular fields.