fix: Changing headers on base class doesn't change them in subclasses

[adrien-k]

This can lead to a serious security issue if used as advised in the README

You can also set any specific HTTP header using the same way. As mentioned above, headers are thread-safe, so you can set headers dynamically, even in a multi-threaded environment:

ActiveResource::Base.headers['Authorization'] = current_session_api_token

If we consider this simple model:

ApiModel < ActiveResource::Base
  self.site = "http://api.some-site.com"
end

And the following sequence:

ActiveResource::Base.headers['Authorization'] = "Bob's TOKEN"
# Request made in Bob's name
ApiModel.find(1) 

ActiveResource::Base.headers['Authorization'] = "Alice's TOKEN"
# The request is still made with Bob's credentials, as ApiMode did read the header and kept a stale copy of it!!!
ApiModel.find(1) 

The fix should be compatible with the thread-safe attribute, although the code may need a second look.

[rails-bot]

This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails team are limited, and so we are asking for your help.

If it is an issue and you can still reproduce this error on the master branch,
please reply with all of the information you have about it in order to keep the issue open.

If it is a pull request and you are still interested on having it merged please make sure it can be merged clearly.

Thank you for all your contributions.

[rails-bot]

This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails team are limited, and so we are asking for your help.

If it is an issue and you can still reproduce this error on the master branch,
please reply with all of the information you have about it in order to keep the issue open.

If it is a pull request and you are still interested on having it merged please make sure it can be merged clearly.

Thank you for all your contributions.