There are a few places that the session id to shown in various error logs. Generally in these places it is enough to show a prefix, enough to identify the session uniquely in a log file and align it with other sources, but we don't need the full sid and its a risk having it floating around so readily.

I'm thinking we redact in a single place and we could not redact if debugging is on for dev boxes.