verify that internally used headers are not present in incoming request

extra security: to cover a potential hole if in some code path these
headers won't be explicitly set

Change-Id: I98b86a562569cf24979b6e8b9abefe84c8181dd9
Reviewed-on: http://review.couchbase.org/43216
Reviewed-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>
Tested-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>
use atoms as json keys in audit code for greater efficiency

Change-Id: I57f81abff686eed683e58c87dc8128631e9d27ab
Reviewed-on: http://review.couchbase.org/43217
Reviewed-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>
Tested-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>