Logging the whole request body is the most useful thing you can do while debugging a sign-in flow and the worst thing you can leave in. A password lives for the length of a request; a log line lives for as long as your retention policy says, on a system with a completely different set of people who can read it.
The response here is identical on both builds. The only difference is a line nobody sees until an incident, which is exactly why this one survives review.
POST /sessionIdentical responses. Open the log pane and compare what each build wrote.
Log the identifier, never the credential. The user id tells you which sign-in this was; the password tells you nothing you needed and everything somebody else wants.
The engine holds a registry of this build's secrets and records whenever one of them turns up in a response body, a header, a cookie or a log line — stamped as it happens, so the finding names the call that leaked it rather than the place somebody later noticed.