Browsers always follow 3xx redirects, and it's not possible to intercept requests between sending the first and any redirects. This causes an issue with in-browser OAuth, as requests must be signed and the signature includes the path.

We should add the ability to get the header back as e.g. X-WP-Status instead, and always return 200.