Support authentication of redirects, sanitize untrusted responses.

* Track multiple contexts so that if/when we can authenticate redirects, we can
  support redirects to different hosts.
* We want to be able to return unauthenticated errors to the user because they
  can be helpful in debugging, but we want to ensure that their content isn't
  used because the user is trusting us not to give them untrusted data. Hence
  the SanitizedResponse class.