Auth token is echoed in health status api

That’s odd. I just checked one of my instance (current stable) and it’s not there, as expected:

Possibly your code files have old, obsolete files left that might cause this kind of behavior. Not sure though.