v2.2.1

• Bugfix: It is no longer possible to send Cookie or Authorization headers to ESI requests on another domain, unless explicitly added in manually using the before_esi_include_request event.
• Bugfix: ESI requests on the same domain would previously "loopback" to the current server_addr and server_port even if the scheme was different. We now check the scheme matches too before making this optimisation.
• Feature: ESI "loopback" can now be disabled with esi_attempt_loopback.