vulnerability-fix: filter out x-hails-user

We forgot to port this from the old  version of Hails.
As a result a user can just set x-hails-user and bypass any
authenticatoin.

Thanks to Jeff Seibert for finding this.
Merge pull request #82 from scslab/x-hails-user-vuln

vulnerability-fix: filter out x-hails-user