Consuming x-ms-via-extensions-route header, fixes #1345

Since we don't know its reader role, maybe tweak the comment to Disallow GET requests from extensions bridge or something.