FIX: Invalid `Location` on resource creation 

- when no `Origin` is defined (as in RESTClient),
- with cross-origin resource sharing.

Now:
- `hideLocationParts` (formerly `rewritePath`) is disabled by default
and its structure is more shallow.
FIX: Simplified configuration by using defaults.

Now:
- (upstream) `host` equals `localhost` by default.