Only transform request headers for allowed hosts.

We should only be sending the token to a defined list of hosts.

1. 3rd party APIs may reject the response if it doesn't accept the header.
1. Potential security issue by sending the token to 3rd partys.