What if the headers have both `X_REWRITE_URL` and `X_ORIGINAL_URL`? Then only one is removed and subrequest could use the wrong request uri again.