It's late, but you should generate the trace ID for each request on the client, not pass it back to the client.