Auth hardening breaks API clients

A public hardening checklist changed proxy header behavior. Browser auth appears fine, but downstream API flows now break because the app no longer sees the scheme and host headers it expects.