Remove auth token from log message

api/base.py

@@ -69,6 +69,8 @@ class RequestHandler(webapp2.RequestHandler):
                 else:
                     err_msg = 'Invalid OAuth2 token.'
                     headers = {'WWW-Authenticate': 'Bearer realm="{}", error="invalid_token", error_description="{}"'.format(site_id, err_msg)}
+                    if 'Authorization' in self.request.headers:
+                        self.request.headers['Authorization'] = '<auth token removed>'
                     log.warn('{} Request headers: {}'.format(err_msg, util.str_from_dict(self.request.headers)))
                     self.abort(401, err_msg, headers=headers)