Redirects should remove `Authorization` header when going to different host (nodejs)

Redirects should remove the `Authorization` header when going to different hosts, because otherwise the contents of `Authorization` is sent to third parties which is a security vulnerability. It also breaks applications.

See [discussion about vulnerability](https://lists.apple.com/archives/webkitsdk-dev/2011/Mar/msg00004.html) for Apple's webkit circa 2011:

See also [discussion on python request vulnerability](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1829).

See [issue](https://github.com/minio/minio/issues/5155) when I was using superagent to have a redirect from an app using `Authorization` to Minio that was expecting its own `Authorization` header.

See [superagent header removal code](https://github.com/visionmedia/superagent/blob/4108c34164d24fecde829b8f80a4626963813cd9/lib/utils.js#L60) which is called from[ code that detects whether the host has changed.](https://github.com/visionmedia/superagent/blob/master/lib/node/index.js#L440)

Trace redirect handling in the Node client, starting with the linked lib/node/index.js code that detects host changes and lib/utils.js header-removal logic. Confirm the behavior for redirects to a different host and ensure Authorization is no longer forwarded, while same-host behavior remains unchanged.

Written by the indexing model from the issue text.