From bf2d96c9e2493a0fbbd819fa2aa57f580f98a852 Mon Sep 17 00:00:00 2001
From: Michael Dubner <pywebmail@list.ru>
Date: Fri, 13 May 2016 23:11:30 +0300
Subject: [PATCH] GH-3: keep hook_private_key away from logged parameters

---
 index.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/index.js b/index.js
index be3cc06..8ab0b4f 100644
--- a/index.js
+++ b/index.js
@@ -82,10 +82,13 @@ Client.prototype.request = function (url, opts, cb) {
   url =  self.protocol + "://" + self.host + ":" + self.port + url;
   opts.json = opts.json || {};
   if (self.attemptAuth === true) {
-    if (opts.json === true) {
-      opts.json = {};
+    if (!opts.headers) {
+      opts.headers = {};
+    }
+    opts.headers.hook_private_key = opts.json.hook_private_key || self.hook_private_key;
+    if (opts.json && opts.json.hook_private_key !== undefined) {
+        delete opts.json.hook_private_key;
     }
-    opts.json.hook_private_key = opts.json.hook_private_key || self.hook_private_key;
   }
 
   // TODO: add ability to extend other endpoints besides files