Fix ml-security

- Browser can keep ```Authorization``` header even when authorization is
set to application-level.