vm: share security token between contexts

By default, each `v8::Context` has a different Security Token, which
prevents access to one context from another.

fix #7140
http: don't send empty, null or undefined headers

if client sets any of the header to null, empty or undefined
 http shouldn't send those headers to server, #7305