[Feature] Include Google Identity Aware Proxy cookies when APP_ORIGIN calls API_HOST

Description of Feature

I am self-hosting growthbook on a Google Kubernetes Engine cluster, and I would like to protect the frontend and the api with Google Identity Aware Proxy (IAP), while exposing a growthbook proxy for our mobile app.

I am encountering an issue when the growthbook-api.example.com is protected with IAP:

• I access APP_ORIGIN url in my browser, and authenticate with Google
• I eventually GET growthbook.example.com with a bunch of IAP related cookies included in the request headers (__Host-GCP_IAP_AUTH_TOKEN_xxx, GCP_IAP_UID, GCP_IAP_XSRF_NONCE_xxx)
• APP_ORIGIN eventually makes a call on my behalf to API_HOST, but this gets 401'd by IAP because the only cookies that get included with this request is GCP_IAP_UID)

Are there any config changes I can implement on my end to include all of the necessary cookies when APP_ORIGIN calls API_HOST, or would this require code changes?

As a side note, I wish I didn't have to expose API_HOST to the internet, the APP_ORIGIN and API_HOST live inside the same container, why can't APP_ORIGIN call API_HOST via localhost inside the container on my behalf, instead of instructing my browser to call the API_HOST via the internet? In that case, I could just expose APP_ORIGIN and a growthbook proxy which would make everything more secure.