Tornado SimpleAsyncHTTPClient strips credentials on cross-origin redirects

SimpleAsyncHTTPClient now removes Authorization and Cookie headers on cross-origin redirects, matching libcurl behavior.

Users of Tornado's SimpleAsyncHTTPClient with follow_redirects=True (default) who rely on credentials being stripped on redirect.

Update Tornado to version 6.5.6 or later to prevent credential leakage on cross-origin redirects.