removed HTTP_ prefix from documented request headers

HTTP_ prefixed headers like HTTP_AUTHORIZATION are sending by clients just as AUTHORIZATION, so the documentation should respect it