fix bug with request_headers being rewritten

At least for clients using OAuth, retrying fails with 400 or 401 errors because request headers are modified by 'failure response'.
This change fixes the problem and allows retries to actually work in those scenarios.

Bug  was first noticed about 2-3 years ago, but reason (and solution) for it surfaced only now.