FR: proxy mode guest access

[gfrankliu]

When running gcp-iap-auth in proxy mode, it would be great to let the traffic through, not giving 401, in case when the jwt can't be validated or doesn't exist. This will allow backend application to provide the guest content or secondary login option.

In such cases, the gcp-iap-auth should clear the bad jwt header, and also clear the email-header, etc. to prevent clients from spoofing the login. The backend can then trust the email-header to decide if it is authenticated request or anonymous request.