Emphasises that it's a black list, and clarifies that you need to
set it to empty to get authorization and cookie headers.