fix leaking of unneeded headers to applications

`X-Storage-Token` and `Cookie` headers were leaked into CGI environment
There is no need for an application to know that information