The header is echoed on the response and written into every log line. Both readers (the proxy and apiHandler) now accept it only when it matches ^[A-Za-z0-9-]{8,64}$ and otherwise use a fresh id.
