Update outbound X-CS behavior in light of unified

The unified design means that app requests, which are mostly
targeted at /w/api.php, would get responses with outbound X-CS: ON,
precluding the apps from operator differentiation for multi-SIM
scenarios.

Separate topics for consideration after this patch:

When the extensive if-elseif logic in VCL is updated
to do broader tagging, some operators will have outbound X-CS
values triggering the apps to make checks against the API for
an explicit JSON object dictating enabled/disabled status for
zero-rating. In practice, that will be on networks with lots of
devices incapable of running apps. Apps also constitute a relatively
smaller portion of traffic from mobile devices.

Nonetheless, it may make sense to define an outbound X-CS blacklist
to help those mobile devices avoid unnecessary round trips to the
API for the formal JSON response.

Change-Id: I0a56eaac2d9df89377b4e379fc849fc685a39112