Strip auth headers when redirected to another host.

These are potentially private and we don't want to leak them to another
host, regardless of whether they're created by the calling application or
by the Authenticator.
Merge pull request #847 from square/jwilson_0519_strip_auth_headers

Strip auth headers when redirected to another host.