don't pass through headers from the incoming req

when implementing #228 I accidentally passed through all the headers by using
_.extend.

fixes #237: this bug was caused by passing through the `host` header, which
will lead to the api proxy trying to make an https request against the http
render app instead of the actually configured api host which expects the https
connection
Merge pull request #241 from c089/fix-leaking-headers

don't pass through headers from the incoming req