Vue Storefront middleware: forwarding client timezone headers to commerce backend without leaking auth headers

We're running Vue Storefront 2.x with the server middleware (middleware.config.js) proxying a commerce backend, and we need backend date fields — order dates, promotion start/end times — to respect each shopper's region.

The documented behavior is that the integration's axios api-client forwards cookies from the incoming request to preserve session identity, but there appears to be no built-in convention for propagating locale or timezone context (e.g., a custom X-Timezone header or Accept-Language) through the middleware to the backend. Blindly forwarding all incoming headers seems risky since it could leak or conflict with authorization headers, so we assume a whitelist approach is needed.

A second concern is SSR consistency: if timezone conversion happens only in the browser via Intl APIs, server-rendered dates may mismatch after hydration, so we're unsure whether normalization belongs in the middleware, an extension method, or the composable layer.Which headers are safe and sufficient to whitelist for regional date handling? Should conversion happen server-side in a middleware extension or client-side after hydration? And is there a documented pattern for this in the newer standalone SDK/middleware split versus older @vue-storefront/middleware versions?