Credential disclosure via case-sensitive redirect filtering

Information disclosure in urllib3 before 1.24.2 allows remote attackers to obtain Authorization credentials through a cross-origin redirect. PoolManager.urlopen removes only the exact-cased Authorization key because its plain header dictionary lookup is case-sensitive. Exposure requires an application to send credentials and follow an attacker-influenced redirect to another host, port, or scheme; the destination can read the header or receive it over cleartext HTTP.