Comment by floobertoober

Maybe scrub cookies and authorization headers by default, but make them an opt-in for bugs where they're relevant?

Edit: it looks like this is already the case!