The capture_headers should default to true (which is also the current behavior). If set to false, HTTP headers (and potentially other headers) should not be logged on transactions, spans or errors.
Besides being documented on the configuration page, this config option should also be documented on the performance optimization page.