Don't forward authorization header across redirects to different hosts

When redirecting to a different host, we should blow away any authorization header.  This has caused issues with AWS, with npm install from private GitHub repos (ping @isaacs), and other servers.

Also see prior discussion at #160, #450, #860, #1058.
So, if we redirect from `abc.com:8080` to `abc.com:1234` we preserve auth headers?

Seems like they should be dropped whenever the `self.uri.host` changes, even if the change is only the port.