[security] do not emit HTTP_PROXY to CGI env