You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
InternalsArea: what it touches
Bug FixesKind: in v2.1.238,
Bug FixesSection of the release
What
Outgoing request headers are now cleaned so only one credential goes out: a cookie removes the Authorization header, and an Authorization header removes both the cookie and X-Organization-Uuid.
Details
The bearer header is now built by a shared constructor rather than each site writing Bearer itself.
Evidence
X-Organization-Uuid
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
