Allow Digest strategy to work with mounted apps

The Authorization header's uri field is check against request.url, which doesn't work for mounted apps.  This can be fixed by checking against request.originalUrl instead, when it is present.