v2.8.7

Fix: app_request sent bodies double-encoded.

A string body was JSON-stringified a second time, so a pre-serialised payload reached the server as a quoted, escaped string. JSON APIs read that as an empty parameter set and answer with an ordinary validation error, so the tool reported what looked like a legitimate backend rejection and nothing hinted the payload had been mangled. Strings are now sent verbatim (urlencoded and raw bodies work too); objects still get exactly one stringify.

Same release fixes a sibling bug: header lookups were exact-case, so passing content-type or authorization in lower case added a second header next to your own, stamping the JSON content type over a urlencoded body and the auto bearer over an explicit token. All reads are now case-insensitive.