Remove cookie and auth header stripping
Remove cookie and auth header stripping

I don't think the cookie stripping actually works -- the `if`'s are
skipped because of the `break` above. We may actually want to strip
cookies so that we don't send our own `*.hypothes.is`-domain cookies
(such as sensitive session or auth cookies) on to third-party servers.
But these `if`'s don't work in this location in the nginx config.

I don't think the `Authorization` header stripping is necessary.
Requests to Via 3's nginx endpoint don't include `Authorization`
headers: the request is sent by PDF.js's JavaScript code.

I'm not sure what the `Set-Cookie` header stripping is for. Apparently
we don't want third-party sites to be able to set cookies, when being
browsed in Via? But why? Won't this break sites? And in future we *do*
want LMS users to annotate content that requires them to be logged in.
It's probably not doing much harm right now because Via 3's nginx
endpoint is only used for PDF's. But it doesn't seem like something we
want.

hypothesis/via,hypothesis/via,hypothesis/via