Only copy private headers in API subrequests

This should include things like X-Client-Id, X-Forwarded-For,
X-Annotator-Auth-Token, etc, but not clobber Content-Length. Also,
copy the authorization header in case we start using that to convey
authorization.