Revert to Site-Url header, but make sure redirects use it.

Using X-Forwarded-Host and X-Forwarded-Port was a bad idea,
because these headers can be easily if wwwhisper is behind
a proxy.
Use auth_request off directive to simplify nginx config.