Add failing test for authorization header forwarded across hosts
Don't forward authorization header across requests to different hosts

Fixes #450 and fixes #860.
Make expected behavior clearer
Merge pull request #1184 from nylen/fix-auth-redirect

Don't forward authorization header across redirects to different hosts