Maintain specified headers for redirects

[ctate]

Hey @ForbesLindesay - I ran into #4 with this code:

request('GET', 'https://api.github.com/repos/isaacs/npm', {followRedirects: true, headers: {'User-Agent': 'http-basic'}}, function (err, res) {
  if (err) throw err;
  console.log(res.statusCode); // error 403
});

This PR fixes the issue by maintaining all original headers through redirects except for "content-length" in GET requests (which should also help with the other issue mentioned in the comment). I also added a little test.

Let me know if this works or if you'd like it to work differently. Thanks!

[ForbesLindesay]

I think we should explicitly copy over a short list of headers. Perhaps even specify a default list and allow the user to extend that list. The issue is that if I send an auth header to a trusted website, but it redirects me to a malicious website by accident, I might then expose my credentials. Not sure the best API here.

[ctate]

That works for me. I just need User-Agent for GitHub. Updated PR.

[ctate]

Actually - updated to add the option allowRedirectHeaders so it's flexible and better for backwards compatibility.