filter_parameter_logging in ApplicationController filters sensitive information like password. But when exception is triggered while logging in, i.e. AuthenticityToken one, exception_logger will store all parameters as they come with the request, including password.
I was looking into lib/logged_exception.rb and I think the method request=(request) could be the place where filtering sensitive parameters should be done.
To keep it DRY, would it be possible to take the settings from filter_parameter_logging in ApplicationController and filter it?