Don't sent headers on passthrough

Prevents aggressive cache headers from being set when st won't serve the
route.
Fix #23: Don't overwrite req.url
Make traversal URLs a 403, not 404 or passthrough