Sanitize Content-Disposition; filename

As defined in http://tools.ietf.org/html/rfc2183#section-2.3 this removes
directory separators from filename hints in http_responses.

Perhaps more sanitizing is needed. This pull introduces a location where those checks can go.