follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets (CVE-2026-40895) | HOL Guard CVE