A page cannot read its own request headers, so these come back from an endpoint that reports what arrived. Headers our own proxy adds are marked as ours rather than hidden.