Propagate Authorization header on redirects, close #2116