We might want to consider allowing the `Authorization` header to be preserved in cases of `http`->`https` redirects. See discussion https://github.com/encode/httpx/discussions/1846