Don't expose "X-Powered-By" response header

Thanks, vhssunny1 @ HackerOne!