Add proxy.auth.* for controlling downstream authorization headers

Fixes gh-19