[requests.Session] lost headers when meet 301/302/307 redirect

Summary.


Request by using [requests.Session]. If set session headers. Headers will lost When met 301/302/307 redirect.

## Expected Result
My custom header should in [resp.request.headers]
```python
{ 'Content-Type': 'application/json;charset=UTF-8' }
``` 
## Actual Result
```
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): bing.com:80
DEBUG:urllib3.connectionpool:http://bing.com:80 "GET / HTTP/1.1" 301 0
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): cn.bing.com:80
DEBUG:urllib3.connectionpool:http://cn.bing.com:80 "GET / HTTP/1.1" 200 46302
{'User-Agent': 'python-requests/2.21.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'
```
{ 'Content-Type': 'application/json;charset=UTF-8' } not in [resp.request.headers].
## Reproduction Steps

```python
import logging
logging.basicConfig()
logging.getLogger().setLevel(logging.DEBUG)
requests_log = logging.getLogger("requests.packages.urllib3")
requests_log.setLevel(logging.DEBUG)
requests_log.propagate = True

import requests
ss = requests.Session()
ss.headers.update({
            'Content-Type': 'application/json;charset=UTF-8'
        })
resp = ss.get('http://bing.com')
print(resp.request.headers)
```

## System Information

    $ python -m requests.help

```
{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": "2.6.1"
  },
  "idna": {
    "version": "2.8"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.7.3"
  },
  "platform": {
    "release": "5.3.0-59-generic",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "1010102f",
    "version": "19.0.0"
  },
  "requests": {
    "version": "2.21.0"
  },
  "system_ssl": {
    "version": "1010102f"
  },
  "urllib3": {
    "version": "1.24.3"
  },
  "using_pyopenssl": true
}
```


Hello,

Why would you set the _Content-Type_ header for the **GET** request? As far as I know it's generally recommended  not to set _Content-Type_ by hand, even when used correctly with **POST** or **PUT** methods. Requests will automatically generate the right value if it's not explicitly set.

Anyway, stripping of _Content-Type_ header was added in this issue #3490 to prevent a bug.

Maybe they're confusing `Content-Type` with `Accept` where the former indicates what you're sending and the latter indicates what you'd like the server to send

> Hello,
> 
> Why would you set the _Content-Type_ header for the **GET** request? As far as I know it's generally recommended not to set _Content-Type_ by hand, even when used correctly with **POST** or **PUT** methods. Requests will automatically generate the right value if it's not explicitly set.
> 
> Anyway, stripping of _Content-Type_ header was added in this issue #3490 to prevent a bug.

"Content-Type" just an example. Sorry for use that not standard header example. My problem is I set header: "'Authorization': token", got same issue.

That's a security feature. When redirecting clients must not resend authorization because your credentials for one URL might not be the credentials you want to send to another. You should use a real authentication handler rather than authentication headers, see also:

- https://toolbelt.readthedocs.io/en/latest/authentication.html
- https://requests.readthedocs.io/en/master/user/authentication/

I'm going to resolve this since sigmavirus24 has included the relevant links. Removal of headers with potentially sensitive information are removed before redirect to prevent credentials and other secrets from being leaked.