code: private Request createTunnelRequest() throws IOException {
      Request proxyConnectRequest = new Request.Builder()
          .url(route.address().url())
          .method("CONNECT", null)
          .header("Host", Util.hostHeader(route.address().url(), true))
          .header("Proxy-Connection", "Keep-Alive") // For HTTP/1.0 proxies like Squid.
          .header("User-Agent", Version.userAgent)
          .build();
  
      Response fakeAuthChallengeResponse = new Response.Builder()
          .request(proxyConnectRequest)
          .protocol(Protocol.HTTP_1_1)
          .code(HttpURLConnection.HTTP_PROXY_AUTH)
          .message("Preemptive Authenticate")
          .body(Util.EMPTY_RESPONSE)
          .sentRequestAtMillis(-1L)
          .receivedResponseAtMillis(-1L)
          .header("Proxy-Authenticate", "OkHttp-Preemptive")
          .build();
  
      Request authenticatedRequest = route.address().proxyAuthenticator()
          .authenticate(route, fakeAuthChallengeResponse);
  
      return authenticatedRequest != null
          ? authenticatedRequest
          : proxyConnectRequest;
    }
docs: Returns a request that creates a TLS tunnel via an HTTP proxy. Everything in the tunnel request
  is sent unencrypted to the proxy server, so tunnels include only the minimum set of headers.
  This avoids sending potentially sensitive data like HTTP cookies to the proxy unencrypted.
  
  <p>In order to support preemptive authentication we pass a fake “Auth Failed” response to the
  authenticator. This gives the authenticator the option to customize the CONNECT request. It can
  decline to do so by returning null, in which case OkHttp will use it as-is