Feature/is 9286 send custom header

[slunker]

No description provided.

[gary-archer]

I would maybe maybe copy in a brief comment to the README also, to promote developer understanding of security:

Cookie Security

• SameSite=strict cookies are sent to APIs, which cannot be sent from malicious sites
• To ensure that only precise whitelisted origins can send cookies to APIs, a 'token-handler-version': '1' header should be sent on every request to the OAuth Agent. In cross-origin deployments this ensures that a CORS preflight request authorizes access.

[luisgoncalves]

I would maybe maybe copy in a brief comment to the README also, to promote developer understanding of security:

Cookie Security

* SameSite=strict cookies are sent to APIs, which cannot be sent from malicious sites

* To ensure that only precise whitelisted origins can send cookies to APIs, a 'token-handler-version': '1' header should be sent on every request to the OAuth Agent. In cross-origin deployments this ensures that a CORS preflight request authorizes access.

Saying "should be sent" may look like the developer needs to do something for this to happen when invoking the OAuth Agent, which is not the case because the library handles this, right? Developers still need to include the headers in API calls (i.e. via the OAuth Proxy); perhaps that's what you meant?

If so (and if the text is added), the text should probably be clear about both things.

[slunker]

I updated the readme with your suggestions @gary-archer and @luisgoncalves