a body field or header whose name contains one of these (any case) is logged as [REDACTED], so passwords and tokens stay out of logs.
[REDACTED]
final List<String> redact;