Pass whitelisted headers to tunneling proxy.  Organize all tunneling logic.

Fix #1019
Incorporates #1028