canary target: https://www.internalfb.com/intern/bug-bounty/get-canary-token/2bace3b3b1d64d3bb07ab0bb56182896/

  /r/<301|302|303|307|308>?u=URL   redirect, defaults to canary
  /canary/<code>                   straight at the canary
  /chain/<n>?u=URL                 n hops then land
  /meta?u=URL                      meta-refresh
  /js?u=URL                        script navigation (headless only)
  /iframe?u=URL                    subresource load
  /feed?u=URL                      RSS with the target in link/enclosure
  /oembed?u=URL[&probe=1]          oEmbed document
  /og?u=URL[&probe=1]              metadata aiming a SECOND fetch at target
  <anything else>                  logged, returns 200

probe=1 gives every metadata vector its own callback path, so the log names
which tag the fetcher actually followed. Run it that way first - aiming all
of them at the canary at once tells you a fetch happened but not which tag
caused it, and that is the part you need.

every request is written to the log with full headers.