Strip auth headers when redirected to another host.

These are potentially private and we don't want to leak them to another
host, regardless of whether they're created by the calling application or
by the Authenticator.