Update whitelisting and blacklisting behavior

[joladev]

To avoid dropping useful header names this updates the SDK to allow headers by default, and that headers are scrubbed instead of dropped if a blacklist or whitelist is applied.

Note that User-Agent is always passed, since it is required by the API. Cookie and Authorization are always scrubbed for security reasons.