WIP: Drop authentication headers on redirect.

TODO: retain them on same-origin redirects.