> But just like I don’t use custom HTTP headers because of concern that proxies may strip them off
Is this an actual problem? HTTP headers are normally significant in REST APIs (well, in HTTP generally), so it seems unreasonable that a proxy would alter them.