Response value shouldn't include request headers

[hadley]

Since you might think that it's a good idea to cache the results in an RDS and then commit that to GitHub and then accidentally expose your API key 😬

[gaborcsardi]

Yeah, that's a good argument for omitting the headers. OTOH the headers and the API key are nice when you want to get the next page, and the current implementation works even if your session was saved and later reloaded, e.g. like it happens on Posit Cloud.

So this is a breaking change for some workflows.

The security concerns probably trump the other issues though, so yes, we can remove the headers from the response.

[jennybc]

Related: In gargle, I have a redact_response() helper:

https://github.com/r-lib/gargle/blob/ef00eb0581a8eda05185a3a6348f80cff522dd76/R/response_process.R#L213-L218

Whenever I process a response, I (probably) call redact_response() on it:

https://github.com/r-lib/gargle/blob/ef00eb0581a8eda05185a3a6348f80cff522dd76/R/response_process.R#L79

https://github.com/r-lib/gargle/blob/ef00eb0581a8eda05185a3a6348f80cff522dd76/R/response_process.R#L135

I rigged this once I started saving the last response by default, for various post mortem investigations. I think it's nice to have some control over it.