Rework all things request headers

* Request’s author headers and headers are merged.
* There’s an “unsafe request flag” to deal with Last-Event-ID being
safe and such.
* Header setting by the UA now happens in the network layer. They are
not exposed to SW.
* Request’s referrer is corrected early on for SW exposure.