add support for --pass-secret flag

cheezy way to show the upstream app that the request came through the proxy
only secure if no man-in-the-middle is possible
new option --rewrite-host to make Host header match upstream

particularly needed for proxying to a heroku app