Function forwarded_fields 

fn forwarded_fields(
    fields: &BTreeMap<String, String>,
) -> impl Iterator<Item = (String, String)> + '_

Drops the client’s access_token from the forwarded query so a legacy query-param credential never reaches the appservice.