Pass whitelisted headers to tunneling proxy.  Organize all tunneling logic.

Fix #1019
Incorporates #1028
tests: Pass squid tunneling test

Still requires 'brew install squid' or whatever, of course.