A 6-character prefix of the token is standard practice for debugging failed auth attempts and is not a security risk. Restored in both required and optional auth paths, and removed the now-incorrect test that asserted its absence. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>