HTTP header injection

[tarcieri]

I think http.rb may be vulnerable to something similar to this:

http://seclists.org/fulldisclosure/2016/Jun/63

I don't think HTTP::URI is properly sanitizing the URL such this won't happen.