remove Authorization header from the redirect call

[legigor]

This workaround fixes the flacking error 400 on API is observed last weeks: 'Authentication information is not given in the correct format. Check the value of Authorization header.'

I've discovered with Fiddler it is getting the correct 302 response to the 1st call when the token is validated but on the 2nd call it fails with the error mentioned above.

There are a few of the mentions of this bug last days:

• https://stackoverflow.com/questions/50016230/authentication-information-is-not-given-in-the-correct-format-check-the-value-o
• https://social.msdn.microsoft.com/Forums/azure/en-US/72de1bac-9657-434f-8811-365c9fe09a69/authentication-information-is-not-given-in-the-correct-format-check-the-value-of-authorization?forum=azureapimgmt

I found the difference between performing the calls from different HTTP client like Postman and CURL. Some of them are not propagating the headers on redirect.

So, the idea of the fix is to disable auto-redirect and on the second call to remove the Authorization header explicitly.

The similar problem and solution is described here:

• https://stackoverflow.com/questions/28564961/authorization-header-is-lost-on-redirect