The bearer token is written in clear to mcp.log whenever a request logs an error #23

Problem

AuthTokenAuthenticator::authenticate() logs the bearer token at debug level (Bearer token = '...'), and the whole Authorization header when it does not match Bearer <token>.

That looks harmless with APP_LOG_LEVEL=info, but config/packages/monolog.yaml also defines filter_for_errors, a fingers_crossed handler with action_level: error whose nested file_log handler has no level. As soon as a request logs one error, every record buffered for that request, debug included, is written to mcp.log. A failed tool call or a token refused by iTop is enough.

Impact

iTop API tokens end up in clear in the log files, whatever APP_LOG_LEVEL says. We found them in the logs of our own instances.

Proposed fix (PR attached)

Keep both messages, drop the secret from them. The logging setup itself stays as it is.