do not include authentication header in .query when jti is recorded in agent

[JohnMoehrke]

Where a query interaction succeeds (is authorized) and thus the AuditEvent has an .agent following the OAuth profile which includes recording of the oauth token jti; then the inclusion of the http authentication header is not needed and the inclusion of it in the AuditEvent presents a security risk (token reuse).

[JohnMoehrke]

Is there some profile of the oauth token that can be described that preserves in the audit that which is useful while explicitly excluding the concerning portions? We need subject matter expert to define this profile of the oauth token for this use-case.