Headers with underscores stripped by default by nginx

[timbarclay]

This isn't an issue as such, but just a point that it might be worth making clear, i.e. in the readme: nginx strips any headers that contain underscores by default, and because this strategy uses the header access_token, there's some extra set-up required for anyone using nginx.