Remove client request sec-username and sec-roles headers - fixes #149