Shouldn't reveal session key in logs