Only transform request headers for allowed hosts.

We should only be sending the token to a defined list of hosts.

1. 3rd party APIs may reject the response if it doesn't accept the header.
1. Potential security issue by sending the token to 3rd partys.
Totes reasonablez :+1: