Fix for Issue 633

Revert the change made during issue #154 and add tests that demonstrate that the filtering works.

Make the default behaviour to always remove the sec-username and sec-roles headers.

See #154 and #633