More cleanups, fail on foreign 'Authorization' headers.