The sign-in with its handoffToken masked, so logging it, or a part that carries it, doesn't leak a live token.