Cannot combine a JWT token with other X-Hasura-* headers

In our application a single user account can have access to multiple brands with different levels of access. Almost every table includes a brand_id so that the data is all filtered to the correct brand. The intention was to set up the permissions system such that an `X-Hasura-Brand-Id` header can be set indicating which brand is being access and then all row filtering and other operations will be restricted to that brand and the permissions can be checked for the combination of that brand and user.

However I'm using Auth0 for authentication and passing JWT tokens and have run across this limitation. I don't think I can put `x-hasura-brand-id` into the JWT as it's something I want the customer to be able to change dynamically without logging in again and having to generate and swap between different tokens for each brand will get quite messy.

The ideal situation for me would be if Hasura let me override permissions headers (with the exception of `x-hasura-allowed-roles`) on the request.

No files or tests are named. Start by tracing how JWT claims and X-Hasura-* request headers are handled, then verify the proposed behavior for Auth0 requests. Done means allowing dynamic permission-header overrides while preserving the restriction on X-Hasura-Allowed-Roles.

Written by the indexing model from the issue text.