Improve security for the proxy view.  Fixes #1308.

* In production, the proxy will only respond to hosts  listed in the settings.PROXY_ALLOWED_HOSTS tuple and the OGC_SERVER hostname.

* Remove the pass through authentication headers.  Pass through authentication headers were getting added to requests outside of their respective realm.

* Add a PROXY_URL setting so administrators can use proxies other than the GeoNode proxy.

* Only forward session cookies to the OWS url since commit ef1cf1 states that session cookies can influence local OWS GetCapabilities requests.