Refuse redirect scheme, host, port and userinfo changes before any redirected request. Preserve same-origin proxy paths, canonical default ports and IPv6 literals, zone identity, the ten-redirect budget and existing CA/pin/explicit-opt-out policy. PVE and PBS password/token/ticket controls reproduce the previous exposure on actual synthetic sockets.
Change-source: pulse-maintainer
pulse-triage[bot]
971d403d01