Added missed poisoned host header test material
[1.3.X] Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.
[1.3.X] Fixed a security issue in get_host.

Full disclosure and new release forthcoming.
[1.3.x] Bump version numbers for security release.
[1.3.X] Fixed a test failure in the comment tests.

Backport of 1eb0da1c5ba3096f218d1df13d02a2b8e1ac7a36 from master.