Don't forward authorization header across redirects to different hosts

When redirecting to a different host, we should blow away any authorization header.  This has caused issues with AWS, with npm install from private GitHub repos (ping @isaacs), and other servers.

Also see prior discussion at #450, #860, #1058.