Redirects should remove `Authorization` header when going to different host (nodejs)

Redirects should remove the Authorization header when going to different hosts, because otherwise the contents of Authorization is sent to third parties which is a security vulnerability. It also breaks applications.

See discussion about vulnerability for Apple's webkit circa 2011:

See also discussion on python request vulnerability.

See issue when I was using superagent to have a redirect from an app using Authorization to Minio that was expecting its own Authorization header.

See superagent header removal code which is called from code that detects whether the host has changed.