fix bug with request_headers being rewritten

At least for clients using OAuth, retrying always fails with 400 or 401 errors because request headers are modified by 'failure response'.
This change fixes the problem and allows retries to actually work.

This bug  was first noticed about 2-3 years ago, but reason (and solution) for it surfaced only now.