incuna/angular-token-auth — pull request #12 by perry (2014-08-01 16:04:35+00:00)
Title: Only transform request headers for allowed hosts.

We should only be sending the token to a defined list of hosts.

1. 3rd party APIs may reject the response if it doesn't accept the header.
1. Potential security issue by sending the token to 3rd partys.