master
Fix CORS wildcard when allow-credentials is true
Bump to go1.26
Introduce trace verbosity config and produce less spans by default
Fix HasSecureHeadersDefined returning false when stsSeconds is 0