spring-cloud-gateway: ProxyExchange.sensitive does not remove headers as documented

I am using spring-cloud-gateway-webflux 2.0.2.RELEASE.

The header fields in sensitive are not removed from the incoming request before being passed to the downstream service. Instead the gateway is unable to add any headers included in sensitive. This is the opposite of the documented behavior, and might leave sensitive information exposed.

// The incoming request contains a header "foo: A"
ProxyExchange.DEFAULT_SENSITIVE.add("foo");
proxyExchange.header("foo", "B");
// The downstream service will receive the header "foo: A"
// The expected header would be "foo: B"