proxy - always adding an extra sec-proxy header

3 webapps (catalogapp, extractorapp, mapfishapp) check the existence of this header and use the security proxy if present / their local ogc proxy if not.

PR for #509