service proxying details needed

[bnewbold]

will eventually want to address:

• possible /.well-known/ pre-flight check
• ability to not forward on service token (or reduce it's scope)
• details about what other headers should be passed along (or not), including content negotiation
• whether to do a "forwarded for" header or not (probably not, for privacy reasons?)
• caching
• websockets
• server-side retries, timeouts, circuit-breaking
• status codes