passthrough options to node-http-proxy

adds `--insecure` and `--no-prepend-path` for `secure: false` and `prependPath: false`, respectively.
I don't know if it works correctly, but the arg is passed through to the underlying object, at least.