No protection against line breaks in header values

Hi,

The following call leads to 'another-header' appearing in the headers sent to the server:

```
>>> r = requests.get('https://httpbin.org/get', params={'q': 'query'}, headers={'my-header': 'a\r\nanother-header: b'})
```

I expected either the line break to be escaped in some way, or an exception to be raised. A new header silently appearing in the request doesn't look right. 

Requests version is 2.9.1, installed with pip. 


Ugh, yeah, good spot. This isn't really ideal: while what occurs here is kinda exactly what you'd expect if you have an understanding of the system, it provides a nice shiny footgun for developers who aren't expecting it, potentially allowing for header injection if they're passing user-provided data directly to a different service. We should probably remove it.

In general, I'm inclined to want to throw errors here, resisting the temptation to guess, but @sigmavirus24 or @kennethreitz may disagree and instead want us to simply strip line terminating characters from headers.


Ugh this is tough. I want to raise exceptions here as well. I'm a bit torn as to when we should introduce those exceptions though. Let's look at it like this: I _think_ most people who are using requests will not be affected by us introducing a new exception around this problem because I _think_ most people aren't going to encounter this. That said, it's still a backwards incompatible change, and the above thinking is what has caused urllib3 to break requests a couple times this year and both of the projects to break other projects (e.g., OpenStack). (That is not to say that I think we're going to break OpenStack with this change, just that we've been fairly confident in the past year that changing X wouldn't hurt anyone and then it does.)


Yeah, so we need to decide whether we can either a) break our normal release policy in order to throw exceptions here, or b) treat this as a strong impetus to move to 3.0.0 in the relatively short term.


I think we can but we shouldn't (break our normal release policy).


So @sigmavirus24, are you thinking that we should attempt to release 3.0.0 sometime in January including a fix for this issue?


When I try the request as described above I get the following traceback. So the request does not succeed, so is this issue still valid? Or would we want to turn the `ValueError` into an exception thrown by the request library? I used requests 2.9.1. 

```
  File "/Users/jonathan/.virtualenvs/test/lib/python2.7/site-packages/requests/adapters.py", line 376, in send
    timeout=timeout
  File "/Users/jonathan/.virtualenvs/test/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 559, in urlopen
    body=body, headers=headers)
  File "/Users/jonathan/.virtualenvs/test/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 353, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/local/Cellar/python/2.7.10/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1053, in request
    self._send_request(method, url, body, headers)
  File "/usr/local/Cellar/python/2.7.10/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1092, in _send_request
    self.putheader(hdr, value)
  File "/usr/local/Cellar/python/2.7.10/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1031, in putheader
    raise ValueError('Invalid header value %r' % (one_value,))
ValueError: Invalid header value 'a\r\nanother-header: b'
```


Because requests runs on a wide range of platforms, we should really be defensive against this possibility rather than relying on httplib to save us. However, the issue is not as urgent as it originally seems. =)


Ok :). I looked through the exceptions that requests currently has. But it seems none of the exceptions match particularly well. I saw that there is

```
class InvalidURL(RequestException, ValueError):
    """ The URL provided was somehow invalid. """
```

So perhaps making an exception called `InvalidHeader` would be a good idea? The reason I'm asking is because I thought that this issue might be a good start to contribute to Requests :)


I couldn't find a pull request for this, so I threw an initial pass with PR #3366.


Thanks for fixing this @nateprewitt!