Ensure "controlled" headers are never pulled from the request.