fix: WSGI apps must not set hop-by-hop headers per PEP 333