The header is not sent at the redirect by design. However, if the host is trusted (there is a token in `IAccessTokens` for it) the header can be sent.