fix: Strip sensitive cookies from proxied requests

[nwalters512]

Tested with the following diff to workspaces/xtermjs/src/server.js:

-app.get('/', (req, res) => res.sendFile(path.join(__dirname, 'index.html')));
+app.get('/', (req, res) => {
+  res.header('X-PL-Cookies', JSON.stringify(req.headers));
+  res.sendFile(path.join(__dirname, 'index.html'));
+});

Before this change, the X-PL-Cookies header on the response included our sensitive auth cookies. After this change, it no longer does!