don't pass through headers from the incoming req

when implementing #228 I accidentally passed through all the headers by using
_.extend.

fixes #237: this bug was caused by passing through the `host` header, which
will lead to the api proxy trying to make an https request against the http
render app instead of the actually configured api host which expects the https
connection