E.g. `Age` (exposing cacheability) or `Via` should be hidden. Add ability to show the headers by passing a special secret request var or header.