Add gotcha about subrequest header filtering

Turns out that subrequests aren't pushed through Nginx's header filters which means that a directive like add_header won't work in a shib_request (or auth_request etc).  Good to know!