Add "source" field to user-agent header

[xavdid]

Why?

Earlier this year, we removed the output of uname from the user-agent header for privacy reasons. It over-collected data we usually didn't need.

Since then, our tech support team has reached out asking us to re-add some of the information to help with complex debugging tasks: sometimes they need to help users identify exactly which machine produced an API call.

Rather than just revert the previous change and reintroduce the same privacy issues that caused its removal in the first place, we're taking a more privacy-focused approach. Rather than send all the PII in plaintext, we hash it first. This way it can still be used to confirm the source of an API call if a user generates the hashes themselves, but isn't sensitive in and of itself.

What?

• add source key to user-agent hash. It's contents are an md5 hash of uname -a
• add tests

See Also

• DEVSDK-3131

[jar-stripe]

sanity check and one comment to fix, but otherwise looks good