fix(cdm): skip the server header probe for pywidevine and pyplayready remote CDMs

A reverse proxy or CDN rewrites the Server header, so upstream refused a working serve API.

docs/guide/drm-and-cdm.md

@@ -324,6 +324,9 @@ remote_cdm:
     so a host without the suffix points the requests at the wrong location. The symptom
     is `404` responses from the server rather than an obvious configuration error.
 
+A pywidevine or pyplayready serve API can operate behind a reverse proxy or a CDN. Refer to
+[Serve APIs behind a proxy](../reference/configuration/drm.md#remote_cdm).
+
 ### Decrypt Labs (hosted KeyXtractor API)
 
 Set `type: decrypt_labs` to use Decrypt Labs' hosted KeyXtractor service, which

docs/reference/configuration/drm.md

@@ -74,6 +74,13 @@ For the two pywidevine/pyplayready backends, field names are read case-insensiti
 styles: `Device Type`/`device_type`, `System ID`/`system_id`, `Security Level`/`security_level`,
 `Host`/`host`, `Secret`/`secret`, `Device Name`/`device_name`.
 
+!!! note "Serve APIs behind a proxy"
+    unshackle does not send upstream's `HEAD` request or examine the `Server` response
+    header, so the server can operate behind a reverse proxy or a CDN that removes or
+    changes that header. Thus a `host` that is not a serve API fails at the first licence
+    request, not when unshackle loads the CDM. On a redirect to a different host or port,
+    unshackle removes the `secret` from the request.
+
 !!! warning "PlayReady `host` needs a `/playready` suffix"
     pyplayready's `RemoteCdm` treats `host` as a base URL and appends its own endpoint paths,
     so a PlayReady entry's `host` must include the trailing `/playready` segment (for example