hide token during the logging

[malafeev]

236

For logged token replace all characters by 'X' except first and last. E.g. 'abcde' becomes 'aXXXe'.