fix(security): prevent Bedrock bearer credential disclosure across redirects (#2377)