Minor fixes

- Adding an optional boolean parameter to `log()` to override stdout emission
- Fixing `req.parsed` by parsing authorization header in `url()`
- Fixing `prep()` by passing the response headers from `respond()`