A developer logs complete access tokens while diagnosing requests. What is the appropriate correction?

1. Redact credentials and use nonsecret correlation data; rotate exposed tokens where necessary.
2. Put the same tokens into response headers for easier comparison.
3. Keep tokens because log systems automatically make them harmless.
4. Disable authorization so tokens are no longer checked.