Don't send 'unsafe' headers

those are the domain of the browser
Don't send authenticated unsafe headers either :)
Merge pull request #8 from raboof/dontSendForbiddenHeaders

Dont send forbidden headers