This tool seems to only sanitize request properties. Access and refresh tokens remain visible in the POST response