vulnerability-fix: filter out x-hails-user

We forgot to port this from the old  version of Hails.
As a result a user can just set x-hails-user and bypass any
authenticatoin.

Thanks to Jeff Seibert for finding this.