Only transform request headers for allowed hosts.

We should only be sending the token to a defined list of hosts.

1. 3rd party APIs may reject the response if it doesn't accept the header.
1. Potential security issue by sending the token to 3rd partys.
Unfortunately not as I don't want to add that dependency to this library.