Add X-Leap-Provenance header. Closes #4356.